diff --git a/detections/cloud/aws_excessive_security_scanning.yml b/detections/cloud/aws_excessive_security_scanning.yml index be06ec9df0..1a9ccb38e5 100644 --- a/detections/cloud/aws_excessive_security_scanning.yml +++ b/detections/cloud/aws_excessive_security_scanning.yml @@ -22,8 +22,11 @@ tags: analytic_story: - AWS User Monitoring asset_type: AWS Account + automated_detection_testing: passed cis20: - CIS 13 + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1526/aws_security_scanner/aws_security_scanner.json kill_chain_phases: - Actions on Objectives mitre_attack_id: @@ -48,6 +51,3 @@ tags: risk_object_type: system risk_score: 20 security_domain: network - automated_detection_testing: passed - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1526/aws_security_scanner/aws_security_scanner.json diff --git a/detections/endpoint/bits_job_persistence.yml b/detections/endpoint/bits_job_persistence.yml index f0444e99c5..e455aba1d1 100644 --- a/detections/endpoint/bits_job_persistence.yml +++ b/detections/endpoint/bits_job_persistence.yml @@ -9,8 +9,10 @@ datamodel: description: The following query identifies Microsoft Background Intelligent Transfer Service utility `bitsadmin.exe` scheduling a BITS job to persist on an endpoint. The query identifies the parameters used to create, resume or add a file to a BITS - job. Typically seen combined in a oneliner or ran in sequence. If identified, review the BITS job created and capture any files written to disk. It is possible for BITS to be used to upload files and this may require further network data analysis to identify. You can use `bitsadmin /list /verbose` - to list out the jobs during investigation. + job. Typically seen combined in a oneliner or ran in sequence. If identified, review + the BITS job created and capture any files written to disk. It is possible for BITS + to be used to upload files and this may require further network data analysis to + identify. You can use `bitsadmin /list /verbose` to list out the jobs during investigation. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=bitsadmin.exe Processes.process IN (*create*, *addfile*, *setnotifyflags*, *setnotifycmdline*, @@ -32,6 +34,7 @@ references: tags: analytic_story: - BITS Jobs + automated_detection_testing: passed dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/windows-sysmon.log kill_chain_phases: @@ -50,4 +53,3 @@ tags: - Processes.user - Processes.dest security_domain: endpoint - automated_detection_testing: passed diff --git a/detections/endpoint/bitsadmin_download_file.yml b/detections/endpoint/bitsadmin_download_file.yml index a7fa7ba5c3..b25ad8dd5a 100644 --- a/detections/endpoint/bitsadmin_download_file.yml +++ b/detections/endpoint/bitsadmin_download_file.yml @@ -38,6 +38,7 @@ tags: analytic_story: - Ingress Tool Transfer - BITS Jobs + automated_detection_testing: passed dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/windows-sysmon.log kill_chain_phases: @@ -57,4 +58,3 @@ tags: - Processes.user - Processes.dest security_domain: endpoint - automated_detection_testing: passed diff --git a/detections/endpoint/disable_registry_tool.yml b/detections/endpoint/disable_registry_tool.yml index 3f31a7ffa2..692aff2d33 100644 --- a/detections/endpoint/disable_registry_tool.yml +++ b/detections/endpoint/disable_registry_tool.yml @@ -26,6 +26,11 @@ references: tags: analytic_story: - Windows Defense Evasion Tactics + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log kill_chain_phases: - Exploitation mitre_attack_id: @@ -42,8 +47,3 @@ tags: - Registry.dest - Registry.registry_value_name security_domain: endpoint - automated_detection_testing: passed - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log diff --git a/detections/endpoint/disable_show_hidden_files.yml b/detections/endpoint/disable_show_hidden_files.yml index 036ea045f8..19047251b2 100644 --- a/detections/endpoint/disable_show_hidden_files.yml +++ b/detections/endpoint/disable_show_hidden_files.yml @@ -28,6 +28,11 @@ references: tags: analytic_story: - Windows Defense Evasion Tactics + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log kill_chain_phases: - Exploitation mitre_attack_id: @@ -45,8 +50,3 @@ tags: - Registry.dest - Registry.registry_value_nam security_domain: endpoint - automated_detection_testing: passed - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log diff --git a/detections/endpoint/disable_windows_behavior_monitoring.yml b/detections/endpoint/disable_windows_behavior_monitoring.yml index 7c5ab7d25e..92760eaeea 100644 --- a/detections/endpoint/disable_windows_behavior_monitoring.yml +++ b/detections/endpoint/disable_windows_behavior_monitoring.yml @@ -28,6 +28,11 @@ references: tags: analytic_story: - Windows Defense Evasion Tactics + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log kill_chain_phases: - Exploitation mitre_attack_id: @@ -44,8 +49,3 @@ tags: - Registry.dest - Registry.registry_value_name security_domain: endpoint - automated_detection_testing: passed - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log diff --git a/detections/endpoint/disable_windows_smartscreen_protection.yml b/detections/endpoint/disable_windows_smartscreen_protection.yml index b127627da0..c86d9eff68 100644 --- a/detections/endpoint/disable_windows_smartscreen_protection.yml +++ b/detections/endpoint/disable_windows_smartscreen_protection.yml @@ -26,6 +26,11 @@ references: tags: analytic_story: - Windows Defense Evasion Tactics + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log kill_chain_phases: - Exploitation mitre_attack_id: @@ -42,8 +47,3 @@ tags: - Registry.dest - Registry.registry_value_nam security_domain: endpoint - automated_detection_testing: passed - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log diff --git a/detections/endpoint/disabling_cmd_application.yml b/detections/endpoint/disabling_cmd_application.yml index 60d544c9bb..2fbb659e41 100644 --- a/detections/endpoint/disabling_cmd_application.yml +++ b/detections/endpoint/disabling_cmd_application.yml @@ -25,6 +25,11 @@ references: tags: analytic_story: - Windows Defense Evasion Tactics + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log kill_chain_phases: - Exploitation mitre_attack_id: @@ -41,8 +46,3 @@ tags: - Registry.dest - Registry.registry_value_name security_domain: endpoint - automated_detection_testing: passed - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log diff --git a/detections/endpoint/disabling_controlpanel.yml b/detections/endpoint/disabling_controlpanel.yml index f4c03a35b8..d25066e65d 100644 --- a/detections/endpoint/disabling_controlpanel.yml +++ b/detections/endpoint/disabling_controlpanel.yml @@ -24,6 +24,11 @@ references: tags: analytic_story: - Windows Defense Evasion Tactics + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log kill_chain_phases: - Exploitation mitre_attack_id: @@ -40,8 +45,3 @@ tags: - Registry.dest - Registry.registry_value_name security_domain: endpoint - automated_detection_testing: passed - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log diff --git a/detections/endpoint/disabling_firewall_with_netsh.yml b/detections/endpoint/disabling_firewall_with_netsh.yml index 03fff72233..572993638b 100644 --- a/detections/endpoint/disabling_firewall_with_netsh.yml +++ b/detections/endpoint/disabling_firewall_with_netsh.yml @@ -26,6 +26,11 @@ references: tags: analytic_story: - Windows Defense Evasion Tactics + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log kill_chain_phases: - Exploitation mitre_attack_id: @@ -45,8 +50,3 @@ tags: - Processes.process_id - Processes.parent_process_id security_domain: endpoint - automated_detection_testing: passed - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log diff --git a/detections/endpoint/disabling_folderoptions_windows_feature.yml b/detections/endpoint/disabling_folderoptions_windows_feature.yml index 59adce28fc..25071310bb 100644 --- a/detections/endpoint/disabling_folderoptions_windows_feature.yml +++ b/detections/endpoint/disabling_folderoptions_windows_feature.yml @@ -26,6 +26,11 @@ references: tags: analytic_story: - Windows Defense Evasion Tactics + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log kill_chain_phases: - Exploitation mitre_attack_id: @@ -42,8 +47,3 @@ tags: - Registry.dest - Registry.registry_value_name security_domain: endpoint - automated_detection_testing: passed - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log diff --git a/detections/endpoint/disabling_norun_windows_app.yml b/detections/endpoint/disabling_norun_windows_app.yml index e77ffbd10c..a6d5beef11 100644 --- a/detections/endpoint/disabling_norun_windows_app.yml +++ b/detections/endpoint/disabling_norun_windows_app.yml @@ -27,6 +27,11 @@ references: tags: analytic_story: - Windows Defense Evasion Tactics + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log kill_chain_phases: - Exploitation mitre_attack_id: @@ -43,8 +48,3 @@ tags: - Registry.dest - Registry.registry_value_name security_domain: endpoint - automated_detection_testing: passed - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log diff --git a/detections/endpoint/disabling_systemrestore_in_registry.yml b/detections/endpoint/disabling_systemrestore_in_registry.yml index f0ed94188f..0de4f02151 100644 --- a/detections/endpoint/disabling_systemrestore_in_registry.yml +++ b/detections/endpoint/disabling_systemrestore_in_registry.yml @@ -27,6 +27,11 @@ references: tags: analytic_story: - Windows Defense Evasion Tactics + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log kill_chain_phases: - Exploitation mitre_attack_id: @@ -43,8 +48,3 @@ tags: - Registry.dest - Registry.registry_value_name security_domain: endpoint - automated_detection_testing: passed - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log diff --git a/detections/endpoint/disabling_task_manager.yml b/detections/endpoint/disabling_task_manager.yml index f1ce08549d..35d551fed1 100644 --- a/detections/endpoint/disabling_task_manager.yml +++ b/detections/endpoint/disabling_task_manager.yml @@ -26,6 +26,11 @@ references: tags: analytic_story: - Windows Defense Evasion Tactics + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log kill_chain_phases: - Exploitation mitre_attack_id: @@ -42,8 +47,3 @@ tags: - Registry.dest - Registry.registry_value_name security_domain: endpoint - automated_detection_testing: passed - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log diff --git a/detections/endpoint/dsquery_domain_discovery.yml b/detections/endpoint/dsquery_domain_discovery.yml index 8e3d815a65..349876a1bc 100644 --- a/detections/endpoint/dsquery_domain_discovery.yml +++ b/detections/endpoint/dsquery_domain_discovery.yml @@ -10,7 +10,7 @@ description: 'The following analytic identifies "dsquery.exe" execution with arg looking for `TrustedDomain` query directly on the command-line. This is typically indicative of an Administrator or adversary perform domain trust discovery. Note that this query does not identify any other variations of "Dsquery.exe" usage.\ - + Within this detection, it is assumed `dsquery.exe` is not moved or renamed.\ The search will return the first time and last time these command-line arguments @@ -46,6 +46,7 @@ references: tags: analytic_story: - Domain Trust Discovery + automated_detection_testing: passed dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1482/atomic_red_team/windows-sysmon.log kill_chain_phases: @@ -63,4 +64,3 @@ tags: - Processes.user - Processes.dest security_domain: endpoint - automated_detection_testing: passed diff --git a/detections/endpoint/malicious_powershell_executed_as_a_service.yml b/detections/endpoint/malicious_powershell_executed_as_a_service.yml index 87849d074d..87500782d1 100644 --- a/detections/endpoint/malicious_powershell_executed_as_a_service.yml +++ b/detections/endpoint/malicious_powershell_executed_as_a_service.yml @@ -26,6 +26,7 @@ references: tags: analytic_story: - Malicious Powershell + automated_detection_testing: passed dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1569.002/atomic_red_team/windows-system.log kill_chain_phases: @@ -46,4 +47,3 @@ tags: - Service_Account - user security_domain: endpoint - automated_detection_testing: passed diff --git a/detections/endpoint/powershell_start_bitstransfer.yml b/detections/endpoint/powershell_start_bitstransfer.yml index 01fa11718a..842a7805d4 100644 --- a/detections/endpoint/powershell_start_bitstransfer.yml +++ b/detections/endpoint/powershell_start_bitstransfer.yml @@ -31,6 +31,7 @@ references: tags: analytic_story: - BITS Jobs + automated_detection_testing: passed dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/windows-sysmon.log kill_chain_phases: @@ -49,4 +50,3 @@ tags: - Processes.user - Processes.dest security_domain: endpoint - automated_detection_testing: passed diff --git a/docs/detections.md b/docs/detections.md index e71e6fc596..40c9ec8b9e 100644 --- a/docs/detections.md +++ b/docs/detections.md @@ -43,6 +43,10 @@ All the detections shipped to different Splunk products. Below is a breakdown by +- [AWS Excessive Security Scanning](#aws-excessive-security-scanning) + + + - [AWS Network Access Control List Created with All Open Ports](#aws-network-access-control-list-created-with-all-open-ports) @@ -136,6 +140,10 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + + + @@ -240,6 +248,8 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + @@ -460,6 +470,28 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + + + + + + + + + + + + + + + + + + + + + @@ -596,6 +628,8 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + @@ -910,6 +944,8 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + @@ -989,6 +1025,8 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + @@ -1044,6 +1082,14 @@ All the detections shipped to different Splunk products. Below is a breakdown by +- [BITS Job Persistence](#bits-job-persistence) + + + +- [BITSAdmin Download File](#bitsadmin-download-file) + + + - [Batch File Write to System32](#batch-file-write-to-system32) @@ -1196,6 +1242,10 @@ All the detections shipped to different Splunk products. Below is a breakdown by +- [DSQuery Domain Discovery](#dsquery-domain-discovery) + + + - [Deleting Shadow Copies](#deleting-shadow-copies) @@ -1452,10 +1502,54 @@ All the detections shipped to different Splunk products. Below is a breakdown by +- [Disable Registry Tool](#disable-registry-tool) + + + +- [Disable Show Hidden Files](#disable-show-hidden-files) + + + +- [Disable Windows Behavior Monitoring](#disable-windows-behavior-monitoring) + + + +- [Disable Windows SmartScreen Protection](#disable-windows-smartscreen-protection) + + + +- [Disabling CMD Application](#disabling-cmd-application) + + + +- [Disabling ControlPanel](#disabling-controlpanel) + + + +- [Disabling Firewall with Netsh](#disabling-firewall-with-netsh) + + + +- [Disabling FolderOptions Windows Feature](#disabling-folderoptions-windows-feature) + + + +- [Disabling NoRun Windows App](#disabling-norun-windows-app) + + + - [Disabling Remote User Account Control](#disabling-remote-user-account-control) +- [Disabling SystemRestore In Registry](#disabling-systemrestore-in-registry) + + + +- [Disabling Task Manager](#disabling-task-manager) + + + - [Dump LSASS via comsvcs DLL](#dump-lsass-via-comsvcs-dll) @@ -1656,6 +1750,10 @@ All the detections shipped to different Splunk products. Below is a breakdown by +- [Malicious Powershell Executed As A Service](#malicious-powershell-executed-as-a-service) + + + @@ -1726,6 +1824,10 @@ All the detections shipped to different Splunk products. Below is a breakdown by +- [PowerShell Start-BitsTransfer](#powershell-start-bitstransfer) + + + - [Probing Access with Stolen Credentials via PowerSploit modules](#probing-access-with-stolen-credentials-via-powersploit-modules) @@ -2324,6 +2426,12 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + + + + + @@ -2347,6 +2455,8 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + - [Detect ARP Poisoning](#detect-arp-poisoning) @@ -2548,6 +2658,28 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + + + + + + + + + + + + + + + + + + + + + @@ -2760,6 +2892,10 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + + + @@ -3261,6 +3397,14 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + + + + + + + @@ -3375,6 +3519,28 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + + + + + + + + + + + + + + + + + + + + + @@ -3527,6 +3693,8 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + @@ -3735,6 +3903,8 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + @@ -4070,6 +4240,14 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + + + + + + + @@ -4348,6 +4526,30 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + + + + + + + + + + + + + + + + + + + + + + + @@ -4510,6 +4712,8 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + @@ -5489,6 +5693,80 @@ Sensitive object access is not necessarily malicious but user and object context #### Test Dataset +_version_: 1 + + +--- + +### AWS Excessive Security Scanning +This search looks for CloudTrail events and analyse the amount of eventNames which starts with Describe by a single user. This indicates that this user scans the configuration of your AWS cloud environment. + +- **Product**: Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: +- **ATT&CK**: [T1526](https://attack.mitre.org/techniques/T1526/) +- **Last Updated**: 2021-04-13 + +
+ details + +#### Search +``` +`cloudtrail` eventName=Describe* OR eventName=List* OR eventName=Get* +| stats dc(eventName) as dc_events min(_time) as firstTime max(_time) as lastTime values(eventName) as eventName values(src) as src values(userAgent) as userAgent by user userIdentity.arn +| where dc_events > 50 +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +|`aws_excessive_security_scanning_filter` +``` +#### Associated Analytic Story + +* AWS User Monitoring + + +#### How To Implement +You must install splunk AWS add on and Splunk App for AWS. This search works with cloudtrail logs. + +#### Required field + +* _time + +* eventName + +* src + +* userAgent + +* user + +* userIdentity.arn + + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------| +| T1526 | Cloud Service Discovery | Discovery | + + +#### Kill Chain Phase + +* Actions on Objectives + + +#### Known False Positives +While this search has no known false positives. + +#### Reference + +* https://github.com/aquasecurity/cloudsploit + + +#### Test Dataset + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1526/aws_security_scanner/aws_security_scanner.json + + _version_: 1
@@ -6828,6 +7106,8 @@ The following analytic identifies the use of PowerShell downloading a file using * Malicious PowerShell +* Ingress Tool Transfer + #### How To Implement To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. @@ -6914,6 +7194,8 @@ The following analytic identifies the use of PowerShell downloading a file using * HAFNIUM Group +* Ingress Tool Transfer + #### How To Implement To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. @@ -7648,6 +7930,169 @@ Administrators may modify the boot configuration. * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/atomic_red_team/windows-sysmon.log +_version_: 1 + + +--- + +### BITS Job Persistence +The following query identifies Microsoft Background Intelligent Transfer Service utility `bitsadmin.exe` scheduling a BITS job to persist on an endpoint. The query identifies the parameters used to create, resume or add a file to a BITS job. Typically seen combined in a oneliner or ran in sequence. If identified, review the BITS job created and capture any files written to disk. It is possible for BITS to be used to upload files and this may require further network data analysis to identify. You can use `bitsadmin /list /verbose` to list out the jobs during investigation. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Endpoint +- **ATT&CK**: [T1197](https://attack.mitre.org/techniques/T1197/) +- **Last Updated**: 2021-03-29 + +
+ details + +#### Search +``` + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=bitsadmin.exe Processes.process IN (*create*, *addfile*, *setnotifyflags*, *setnotifycmdline*, *setminretrydelay*, *setcustomheaders*, *resume* ) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `bits_job_persistence_filter` +``` +#### Associated Analytic Story + +* BITS Jobs + + +#### How To Implement +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. + +#### Required field + +* _time + +* Processes.process + +* Processes.parent_process + +* Processes.process_name + +* Processes.user + +* Processes.dest + + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------| +| T1197 | BITS Jobs | Defense Evasion, Persistence | + + +#### Kill Chain Phase + +* Exploitation + + +#### Known False Positives +Limited false positives will be present. Typically, applications will use `BitsAdmin.exe`. Any filtering should be done based on command-line arguments (legitimate applications) or parent process. + +#### Reference + +* https://attack.mitre.org/techniques/T1197/ + +* https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/bitsadmin + +* https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1197/T1197.md#atomic-test-3---persist-download--execute + +* https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/ + + +#### Test Dataset + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/windows-sysmon.log + + +_version_: 1 +
+ +--- + +### BITSAdmin Download File +The following query identifies Microsoft Background Intelligent Transfer Service utility `bitsadmin.exe` using the `transfer` parameter to download a remote object. In addition, look for `download` or `upload` on the command-line, the switches are not required to perform a transfer. Capture any files downloaded. Review the reputation of the IP or domain used. Typically once executed, a follow on command will be used to execute the dropped file. Note that the network connection or file modification events related will not spawn or create from `bitsadmin.exe`, but the artifacts will appear in a parallel process of `svchost.exe` with a command-line similar to `svchost.exe -k netsvcs -s BITS`. It's important to review all parallel and child processes to capture any behaviors and artifacts. In some suspicious and malicious instances, BITS jobs will be created. You can use `bitsadmin /list /verbose` to list out the jobs during investigation. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Endpoint +- **ATT&CK**: [T1197](https://attack.mitre.org/techniques/T1197/), [T1105](https://attack.mitre.org/techniques/T1105/) +- **Last Updated**: 2021-03-26 + +
+ details + +#### Search +``` + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=bitsadmin.exe Processes.process=*transfer* by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `bitsadmin_download_file_filter` +``` +#### Associated Analytic Story + +* Ingress Tool Transfer + +* BITS Jobs + + +#### How To Implement +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. + +#### Required field + +* _time + +* Processes.process + +* Processes.parent_process + +* Processes.process_name + +* Processes.user + +* Processes.dest + + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------| +| T1197 | BITS Jobs | Defense Evasion, Persistence | +| T1105 | Ingress Tool Transfer | Command and Control | + + +#### Kill Chain Phase + +* Exploitation + + +#### Known False Positives +Limited false positives, however it may be required to filter based on parent process name or network connection. + +#### Reference + +* https://github.com/redcanaryco/atomic-red-team/blob/8eb52117b748d378325f7719554a896e37bccec7/atomics/T1105/T1105.md#atomic-test-9---windows---bitsadmin-bits-download + +* https://github.com/redcanaryco/atomic-red-team/blob/bc705cb7aaa5f26f2d96585fac8e4c7052df0ff9/atomics/T1197/T1197.md + +* https://docs.microsoft.com/en-us/windows/win32/bits/bitsadmin-tool + +* https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/ + + +#### Test Dataset + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/windows-sysmon.log + + _version_: 1
@@ -11162,6 +11607,89 @@ _version_: 3 --- +### DSQuery Domain Discovery +The following analytic identifies "dsquery.exe" execution with arguments looking for `TrustedDomain` query directly on the command-line. This is typically indicative of an Administrator or adversary perform domain trust discovery. Note that this query does not identify any other variations of "Dsquery.exe" usage.\ +Within this detection, it is assumed `dsquery.exe` is not moved or renamed.\ +The search will return the first time and last time these command-line arguments were used for these executions, as well as the target system, the user, process "dsquery.exe" and its parent process.\ +DSQuery.exe is natively found in `C:\Windows\system32` and `C:\Windows\syswow64` and only on Server operating system.\ +The following DLL(s) are loaded when DSQuery.exe is launched `dsquery.dll`. If found loaded by another process, it is possible dsquery is running within that process context in memory.\ +In addition to trust discovery, review parallel processes for additional behaviors performed. Identify the parent process and capture any files (batch files, for example) being used. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Endpoint +- **ATT&CK**: [T1482](https://attack.mitre.org/techniques/T1482/) +- **Last Updated**: 2021-03-31 + +
+ details + +#### Search +``` + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=dsquery.exe Processes.process=*trustedDomain* by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `dsquery_domain_discovery_filter` +``` +#### Associated Analytic Story + +* Domain Trust Discovery + + +#### How To Implement +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. + +#### Required field + +* _time + +* Processes.process_name + +* Processes.process + +* Processes.user + +* Processes.dest + + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------| +| T1482 | Domain Trust Discovery | Discovery | + + +#### Kill Chain Phase + +* Exploitation + + +#### Known False Positives +Limited false positives. If there is a true false positive, filter based on command-line or parent process. + +#### Reference + +* https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1482/T1482.md + +* http://www.harmj0y.net/blog/redteaming/a-guide-to-attacking-domain-trusts/ + +* https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc732952(v=ws.11) + +* https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc754232(v=ws.11) + + +#### Test Dataset + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1482/atomic_red_team/windows-sysmon.log + + +_version_: 1 +
+ +--- + ### Deleting Shadow Copies The vssadmin.exe utility is used to interact with the Volume Shadow Copy Service. Wmic is an interface to the Windows Management Instrumentation. This search looks for either of these tools being used to delete shadow copies. @@ -14212,17 +14740,19 @@ The test data is converted from Windows Security Event logs generated from Attac #### Required field -* logon_process +* signature_id -* dest_user_primary_artifact +* authentication_type * _time -* event_code +* authentication_method -* dest_ip_primary_artifact +* origin_device_domain -* logon_type +* dest_user_id + +* dest_device_id @@ -17800,6 +18330,717 @@ _version_: 3 --- +### Disable Registry Tool +This search is to identifies modification of registry to disable the regedit or registry tools of windows operating system. Since registry tool is a swiss knife in analyzing registry, malware such as RAT or trojan Spy disable this application to prevent the removal of their registry entry such as persistence, file less components and defense evasion. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Endpoint +- **ATT&CK**: [T1562.001](https://attack.mitre.org/techniques/T1562.001/) +- **Last Updated**: 2021-03-31 + +
+ details + +#### Search +``` + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableRegistryTools" Registry.registry_value_name = "DWORD (0x00000001)" by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest +| `drop_dm_object_name(Registry)` +| `security_content_ctime(firstTime)` +|`security_content_ctime(lastTime)` +| `disable_registry_tool_filter` +``` +#### Associated Analytic Story + +* Windows Defense Evasion Tactics + + +#### How To Implement +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. + +#### Required field + +* _time + +* Registry.registry_key_name + +* Registry.registry_path + +* Registry.user + +* Registry.dest + +* Registry.registry_value_name + + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------| +| T1562.001 | Disable or Modify Tools | Defense Evasion | + + +#### Kill Chain Phase + +* Exploitation + + +#### Known False Positives +admin may disable this application for non technical user. + +#### Reference + +* https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry + + +#### Test Dataset + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log + + +_version_: 1 +
+ +--- + +### Disable Show Hidden Files +The following search is to idetifies a modification in registry to prevent the user seeing all the files with hidden attributes. This event or techniques are known on some worm and trojan spy malware that will drop hidden files on the infected machine. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Endpoint +- **ATT&CK**: [T1564.001](https://attack.mitre.org/techniques/T1564.001/), [T1562.001](https://attack.mitre.org/techniques/T1562.001/) +- **Last Updated**: 2021-03-31 + +
+ details + +#### Search +``` + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\Hidden" OR Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\HideFileExt" Registry.registry_value_name = "DWORD (0x00000001)") OR (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowSuperHidden" Registry.registry_value_name = "DWORD (0x00000000)") by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest +| `drop_dm_object_name(Registry)` +| `security_content_ctime(firstTime)` +|`security_content_ctime(lastTime)` +| `disable_show_hidden_files_filter` +``` +#### Associated Analytic Story + +* Windows Defense Evasion Tactics + + +#### How To Implement +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. + +#### Required field + +* _time + +* Registry.registry_key_name + +* Registry.registry_path + +* Registry.user + +* Registry.dest + +* Registry.registry_value_nam + + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------| +| T1564.001 | Hidden Files and Directories | Defense Evasion | +| T1562.001 | Disable or Modify Tools | Defense Evasion | + + +#### Kill Chain Phase + +* Exploitation + + +#### Known False Positives +unknown + +#### Reference + +* https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Tiotua-P/detailed-analysis.aspx + + +#### Test Dataset + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log + + +_version_: 1 +
+ +--- + +### Disable Windows Behavior Monitoring +This search is to identifies a modification in registry to disable the windows denfender real time behavior monitoring. This event or technique is commonly seen in RAT, bot, or Trojan to disable AV to evade detections. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Endpoint +- **ATT&CK**: [T1562.001](https://attack.mitre.org/techniques/T1562.001/) +- **Last Updated**: 2021-03-31 + +
+ details + +#### Search +``` + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableBehaviorMonitoring" OR Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableOnAccessProtection" OR Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableScanOnRealtimeEnable" Registry.registry_value_name = "DWORD (0x00000001)" by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest +| `drop_dm_object_name(Registry)` +| `security_content_ctime(firstTime)` +|`security_content_ctime(lastTime)` +| `disable_windows_behavior_monitoring_filter` +``` +#### Associated Analytic Story + +* Windows Defense Evasion Tactics + + +#### How To Implement +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. + +#### Required field + +* _time + +* Registry.registry_key_name + +* Registry.registry_path + +* Registry.user + +* Registry.dest + +* Registry.registry_value_name + + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------| +| T1562.001 | Disable or Modify Tools | Defense Evasion | + + +#### Kill Chain Phase + +* Exploitation + + +#### Known False Positives +admin or user may choose to disable this windows features. + +#### Reference + +* https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html + + +#### Test Dataset + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log + + +_version_: 1 +
+ +--- + +### Disable Windows SmartScreen Protection +The following search identifies a modification of registry to disable the smartscreen protection of windows machine. This is windows feature provide an early warning system against website that might engage in phishing attack or malware distribution. This modification are seen in RAT malware to cover their tracks upon downloading other of its component or other payload. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Endpoint +- **ATT&CK**: [T1562.001](https://attack.mitre.org/techniques/T1562.001/) +- **Last Updated**: 2021-03-31 + +
+ details + +#### Search +``` + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SmartScreenEnabled" Registry.registry_value_name = "Off" by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest +| `drop_dm_object_name(Registry)` +| `security_content_ctime(firstTime)` +|`security_content_ctime(lastTime)` +| `disable_windows_smartscreen_protection_filter` +``` +#### Associated Analytic Story + +* Windows Defense Evasion Tactics + + +#### How To Implement +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. + +#### Required field + +* _time + +* Registry.registry_key_name + +* Registry.registry_path + +* Registry.user + +* Registry.dest + +* Registry.registry_value_nam + + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------| +| T1562.001 | Disable or Modify Tools | Defense Evasion | + + +#### Kill Chain Phase + +* Exploitation + + +#### Known False Positives +admin or user may choose to disable this windows features. + +#### Reference + +* https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html + + +#### Test Dataset + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log + + +_version_: 1 +
+ +--- + +### Disabling CMD Application +this search is to identify modification in registry to disable cmd prompt application. This technique is commonly seen in RAT, Trojan or WORM to prevent triaging or deleting there samples through cmd application which is one of the tool of analyst to traverse on directory and files. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Endpoint +- **ATT&CK**: [T1562.001](https://attack.mitre.org/techniques/T1562.001/) +- **Last Updated**: 2021-03-31 + +
+ details + +#### Search +``` + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\DisableCMD" Registry.registry_value_name = "DWORD (0x00000001)" by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest +| `drop_dm_object_name(Registry)` +| `security_content_ctime(firstTime)` +|`security_content_ctime(lastTime)` +| `disabling_cmd_application_filter` +``` +#### Associated Analytic Story + +* Windows Defense Evasion Tactics + + +#### How To Implement +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. + +#### Required field + +* _time + +* Registry.registry_key_name + +* Registry.registry_path + +* Registry.user + +* Registry.dest + +* Registry.registry_value_name + + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------| +| T1562.001 | Disable or Modify Tools | Defense Evasion | + + +#### Kill Chain Phase + +* Exploitation + + +#### Known False Positives +admin may disable this application for non technical user. + +#### Reference + +* https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry + + +#### Test Dataset + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log + + +_version_: 1 +
+ +--- + +### Disabling ControlPanel +this search is to identify registry modification to disable control panel window. This technique is commonly seen in malware to prevent their artifacts , persistence removed on the infected machine. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Endpoint +- **ATT&CK**: [T1562.001](https://attack.mitre.org/techniques/T1562.001/) +- **Last Updated**: 2021-03-31 + +
+ details + +#### Search +``` + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoControlPanel" Registry.registry_value_name = "DWORD (0x00000001)" by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest +| `drop_dm_object_name(Registry)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `disabling_controlpanel_filter` +``` +#### Associated Analytic Story + +* Windows Defense Evasion Tactics + + +#### How To Implement +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. + +#### Required field + +* _time + +* Registry.registry_key_name + +* Registry.registry_path + +* Registry.user + +* Registry.dest + +* Registry.registry_value_name + + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------| +| T1562.001 | Disable or Modify Tools | Defense Evasion | + + +#### Kill Chain Phase + +* Exploitation + + +#### Known False Positives +admin may disable this application for non technical user. + +#### Reference + +* https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry + + +#### Test Dataset + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log + + +_version_: 1 +
+ +--- + +### Disabling Firewall with Netsh +This search is to identifies suspicious firewall disabling using netsh application. this technique is commonly seen in malware that tries to communicate or download its component or other payload to its C2 server. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Endpoint +- **ATT&CK**: [T1562.001](https://attack.mitre.org/techniques/T1562.001/) +- **Last Updated**: 2021-03-31 + +
+ details + +#### Search +``` + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=netsh.exe Processes.process= "*firewall*" (Processes.process= "*off*" OR Processes.process= "*disable*") by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `disabling_firewall_with_netsh_filter` +``` +#### Associated Analytic Story + +* Windows Defense Evasion Tactics + + +#### How To Implement +You must be ingesting data that records the filesystem activity from your hosts to populate the Endpoint file-system data model node. If you are using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which you want to collect data. + +#### Required field + +* _time + +* Processes.process_name + +* Processes.process + +* Processes.dest + +* Processes.user + +* Processes.parent_process + +* Processes.process_name + +* Processes.process_id + +* Processes.parent_process_id + + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------| +| T1562.001 | Disable or Modify Tools | Defense Evasion | + + +#### Kill Chain Phase + +* Exploitation + + +#### Known False Positives +admin may disable firewall during testing or fixing network problem. + +#### Reference + +* https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.htm + + +#### Test Dataset + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log + + +_version_: 1 +
+ +--- + +### Disabling FolderOptions Windows Feature +This search is to identify registry modification to disable folder options feature of windows to show hidden files, file extension and etc. This technique used by malware in combination if disabling show hidden files feature to hide their files and also to hide the file extension to lure the user base on file icons or fake file extensions. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Endpoint +- **ATT&CK**: [T1562.001](https://attack.mitre.org/techniques/T1562.001/) +- **Last Updated**: 2021-03-31 + +
+ details + +#### Search +``` + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoFolderOptions" Registry.registry_value_name = "DWORD (0x00000001)" by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest +| `drop_dm_object_name(Registry)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `disabling_folderoptions_windows_feature_filter` +``` +#### Associated Analytic Story + +* Windows Defense Evasion Tactics + + +#### How To Implement +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. + +#### Required field + +* _time + +* Registry.registry_key_name + +* Registry.registry_path + +* Registry.user + +* Registry.dest + +* Registry.registry_value_name + + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------| +| T1562.001 | Disable or Modify Tools | Defense Evasion | + + +#### Kill Chain Phase + +* Exploitation + + +#### Known False Positives +admin may disable this application for non technical user. + +#### Reference + +* https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry + + +#### Test Dataset + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log + + +_version_: 1 +
+ +--- + +### Disabling NoRun Windows App +This search is to identify modification of registry to disable run application in window start menu. this application is known to be a helpful shortcut to windows OS user to run known application and also to execute some reg or batch script. This technique is used malware to make cleaning of its infection more harder by preventing known application run easily through run shortcut. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Endpoint +- **ATT&CK**: [T1562.001](https://attack.mitre.org/techniques/T1562.001/) +- **Last Updated**: 2021-03-31 + +
+ details + +#### Search +``` + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoRun" Registry.registry_value_name = "DWORD (0x00000001)" by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest +| `drop_dm_object_name(Registry)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `disabling_norun_windows_app_filter` +``` +#### Associated Analytic Story + +* Windows Defense Evasion Tactics + + +#### How To Implement +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. + +#### Required field + +* _time + +* Registry.registry_key_name + +* Registry.registry_path + +* Registry.user + +* Registry.dest + +* Registry.registry_value_name + + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------| +| T1562.001 | Disable or Modify Tools | Defense Evasion | + + +#### Kill Chain Phase + +* Exploitation + + +#### Known False Positives +admin may disable this application for non technical user. + +#### Reference + +* https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry + +* https://blog.malwarebytes.com/detections/pum-optional-norun/ + + +#### Test Dataset + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log + + +_version_: 1 +
+ +--- + ### Disabling Remote User Account Control The search looks for modifications to registry keys that control the enforcement of Windows User Account Control (UAC). @@ -17874,6 +19115,164 @@ _version_: 4 --- +### Disabling SystemRestore In Registry +The following search identifies the modification of registry related in disabling the system restore of a machine. This event or behavior are seen in some RAT malware to make the restore of the infected machine difficult and keep their infection on the box. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Endpoint +- **ATT&CK**: [T1562.001](https://attack.mitre.org/techniques/T1562.001/) +- **Last Updated**: 2021-03-31 + +
+ details + +#### Search +``` + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SystemRestore\\DisableSR" OR Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SystemRestore\\DisableConfig" Registry.registry_value_name = "DWORD (0x00000001)" by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest +| `drop_dm_object_name(Registry)` +| `security_content_ctime(firstTime)` +|`security_content_ctime(lastTime)` +| `disabling_systemrestore_in_registry_filter` +``` +#### Associated Analytic Story + +* Windows Defense Evasion Tactics + + +#### How To Implement +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. + +#### Required field + +* _time + +* Registry.registry_key_name + +* Registry.registry_path + +* Registry.user + +* Registry.dest + +* Registry.registry_value_name + + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------| +| T1562.001 | Disable or Modify Tools | Defense Evasion | + + +#### Kill Chain Phase + +* Exploitation + + +#### Known False Positives +in some cases admin can disable systemrestore on a machine. + +#### Reference + +* https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html + + +#### Test Dataset + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log + + +_version_: 1 +
+ +--- + +### Disabling Task Manager +This search is to identifies modification of registry to disable the task manager of windows operating system. this event or technique are commonly seen in malware such as RAT, Trojan, TrojanSpy or worm to prevent the user to terminate their process. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Endpoint +- **ATT&CK**: [T1562.001](https://attack.mitre.org/techniques/T1562.001/) +- **Last Updated**: 2021-03-31 + +
+ details + +#### Search +``` + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableTaskMgr" Registry.registry_value_name = "DWORD (0x00000001)" by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest +| `drop_dm_object_name(Registry)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `disabling_task_manager_filter` +``` +#### Associated Analytic Story + +* Windows Defense Evasion Tactics + + +#### How To Implement +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. + +#### Required field + +* _time + +* Registry.registry_key_name + +* Registry.registry_path + +* Registry.user + +* Registry.dest + +* Registry.registry_value_name + + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------| +| T1562.001 | Disable or Modify Tools | Defense Evasion | + + +#### Kill Chain Phase + +* Exploitation + + +#### Known False Positives +admin may disable this application for non technical user. + +#### Reference + +* https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry + +* https://blog.talosintelligence.com/2020/05/threat-roundup-0424-0501.html + + +#### Test Dataset + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log + + +_version_: 1 +
+ +--- + ### Dump LSASS via comsvcs DLL Detect the usage of comsvcs.dll for dumping the lsass process. @@ -22708,6 +24107,96 @@ _version_: 4 --- +### Malicious Powershell Executed As A Service +This detection is to identify the abuse the Windows SC.exe to execute malicious commands or payloads via PowerShell. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Endpoint +- **ATT&CK**: [T1569.002](https://attack.mitre.org/techniques/T1569.002/) +- **Last Updated**: 2021-04-07 + +
+ details + +#### Search +``` + `wineventlog_system` EventCode=7045 +| eval l_Service_File_Name=lower(Service_File_Name) +| regex l_Service_File_Name="powershell[.\s] +|powershell_ise[.\s] +|pwsh[.\s] +|psexec[.\s]" +| regex l_Service_File_Name="-nop[rofile]* +|-w[indowstyle]*\s+hid[den]* +|-noe[xit]* +|-enc[odedcommand]*" +| stats count min(_time) as firstTime max(_time) as lastTime by EventCode Service_File_Name Service_Name Service_Start_Type Service_Type Service_Account user +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `malicious_powershell_executed_as_a_service_filter` +``` +#### Associated Analytic Story + +* Malicious Powershell + + +#### How To Implement +To successfully implement this search, you need to be ingesting Windows System logs with the Service name, Service File Name Service Start type, and Service Type from your endpoints. + +#### Required field + +* EventCode + +* Service_File_Name + +* Service_Type + +* _time + +* Service_Name + +* Service_Start_Type + +* Service_Account + +* user + + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------| +| T1569.002 | Service Execution | Execution | + + +#### Kill Chain Phase + +* Privilege Escalation + + +#### Known False Positives +Creating a hidden powershell service is rare and could key off of those instances. + +#### Reference + +* https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/dosfuscation-report.pdf + +* http://az4n6.blogspot.com/2017/ + +* https://www.danielbohannon.com/blog-1/2017/3/12/powershell-execution-argument-obfuscation-how-it-can-make-detection-easier + + +#### Test Dataset + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1569.002/atomic_red_team/windows-system.log + + +_version_: 1 +
+ +--- + ### Monitor DNS For Brand Abuse This search looks for DNS requests for faux domains similar to the domains that you want to have monitored for abuse. @@ -23133,6 +24622,8 @@ This search looks for the execution of `nltest.exe` with command-line arguments * Ryuk Ransomware +* Domain Trust Discovery + #### How To Implement To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. @@ -24778,6 +26269,82 @@ Because of imbalance of anomaly data in training, the model will less likely rep #### Test Dataset +_version_: 1 + + +--- + +### PowerShell Start-BitsTransfer +Start-BitsTransfer is the PowerShell "version" of BitsAdmin.exe. Similar functionality is present. This technique variation is not as commonly used by adversaries, but has been abused in the past. Lesser known uses include the ability to set the `-TransferType` to `Upload` for exfiltration of files. In an instance where `Upload` is used, it is highly possible files will be archived. During triage, review parallel processes and process lineage. Capture any files on disk and review. For the remote domain or IP, what is the reputation? + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Endpoint +- **ATT&CK**: [T1197](https://attack.mitre.org/techniques/T1197/) +- **Last Updated**: 2021-03-29 + +
+ details + +#### Search +``` + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=powershell.exe Processes.process=*start-bitstransfer* by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `powershell_start_bitstransfer_filter` +``` +#### Associated Analytic Story + +* BITS Jobs + + +#### How To Implement +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. + +#### Required field + +* _time + +* Processes.process + +* Processes.parent_process + +* Processes.process_name + +* Processes.user + +* Processes.dest + + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------| +| T1197 | BITS Jobs | Defense Evasion, Persistence | + + +#### Kill Chain Phase + +* Exploitation + + +#### Known False Positives +Limited false positives. It is possible administrators will utilize Start-BitsTransfer for administrative tasks, otherwise filter based parent process or command-line arguments. + +#### Reference + +* https://isc.sans.edu/diary/Investigating+Microsoft+BITS+Activity/23281 + +* https://docs.microsoft.com/en-us/windows/win32/bits/using-windows-powershell-to-create-bits-transfer-jobs + + +#### Test Dataset + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/windows-sysmon.log + + _version_: 1
@@ -27510,7 +29077,7 @@ This search monitors for remote modifications to registry keys. #### Search ``` -| tstats `security_content_summariesonly` count values(Registry.registry_key_name) as registry_key_name values(Registry.registry_path) as registry_path min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="\\\\*" by Registry.dest , Registry.user +| tstats `security_content_summariesonly` count values(Registry.registry_key_name) as registry_key_name values(Registry.registry_path) as registry_path min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path="\\\\*" by Registry.dest , Registry.user | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` @@ -29501,7 +31068,7 @@ This search looks for changes to registry values that control Windows file assoc | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | join [ -| tstats `security_content_summariesonly` values(Registry.registry_path) as registry_path count FROM datamodel=Endpoint.Registry where Registry.registry_path=*\\Explorer\\FileExts* by Registry.process_id Registry.dest +| tstats `security_content_summariesonly` values(Registry.registry_path) as registry_path count from datamodel=Endpoint.Registry where Registry.registry_path=*\\Explorer\\FileExts* by Registry.process_id Registry.dest | `drop_dm_object_name("Registry")` | table process_id dest registry_path] | `suspicious_changes_to_file_associations_filter` @@ -33464,6 +35031,8 @@ This search looks for the execution of `adfind.exe` with command-line arguments * NOBELIUM Group +* Domain Trust Discovery + #### How To Implement To successfully implement this search, you need to be ingesting logs with the process name, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. diff --git a/docs/detections.wiki b/docs/detections.wiki index 9a59c287b8..bba9ca3b01 100644 --- a/docs/detections.wiki +++ b/docs/detections.wiki @@ -1490,6 +1490,85 @@ bucket with S3 encryption * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1486/s3_file_encryption/aws_cloudtrail_events.json +''version'': 1 + + + +---- + +===Aws excessive security scanning=== +This search looks for CloudTrail events and analyse the amount of eventNames which starts with Describe by a single user. This indicates that this user scans the configuration of your AWS cloud environment. + +* '''Product''': Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1526/ T1526] +* '''Last Updated''': 2021-04-13 + +
+
+ +====Search==== +`cloudtrail` eventName=Describe* OR eventName=List* OR eventName=Get* +| stats dc(eventName) as dc_events min(_time) as firstTime max(_time) as lastTime values(eventName) as eventName values(src) as src values(userAgent) as userAgent by user userIdentity.arn +| where dc_events > 50 +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +|`aws_excessive_security_scanning_filter` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#AWS_User_Monitoring|AWS User Monitoring]] + + +====How To Implement==== +You must install splunk AWS add on and Splunk App for AWS. This search works with cloudtrail logs. + +====Required field==== + +* _time + +* eventName + +* src + +* userAgent + +* user + +* userIdentity.arn + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1526 +| Cloud Service Discovery +| Discovery +|} + + +====Kill Chain Phase==== + +* Actions on Objectives + + +====Known False Positives==== +While this search has no known false positives. + +====Reference==== + +* https://github.com/aquasecurity/cloudsploit + + +====Test Dataset==== + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1526/aws_security_scanner/aws_security_scanner.json + + ''version'': 1
@@ -10418,7 +10497,7 @@ This search monitors for remote modifications to registry keys. ====Search==== -| tstats `security_content_summariesonly` count values(Registry.registry_key_name) as registry_key_name values(Registry.registry_path) as registry_path min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="\\\\*" by Registry.dest , Registry.user +| tstats `security_content_summariesonly` count values(Registry.registry_key_name) as registry_key_name values(Registry.registry_path) as registry_path min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path="\\\\*" by Registry.dest , Registry.user | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` @@ -10719,7 +10798,7 @@ This search looks for changes to registry values that control Windows file assoc | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | join [ -| tstats `security_content_summariesonly` values(Registry.registry_path) as registry_path count FROM datamodel=Endpoint.Registry where Registry.registry_path=*\\Explorer\\FileExts* by Registry.process_id Registry.dest +| tstats `security_content_summariesonly` values(Registry.registry_path) as registry_path count from datamodel=Endpoint.Registry where Registry.registry_path=*\\Explorer\\FileExts* by Registry.process_id Registry.dest | `drop_dm_object_name("Registry")` | table process_id dest registry_path] | `suspicious_changes_to_file_associations_filter` @@ -11662,6 +11741,8 @@ The following analytic identifies the use of PowerShell downloading a file using * [[Documentation:ESSOC:stories:UseCase#Malicious_PowerShell|Malicious PowerShell]] +* [[Documentation:ESSOC:stories:UseCase#Ingress_Tool_Transfer|Ingress Tool Transfer]] + ====How To Implement==== To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. @@ -11753,6 +11834,8 @@ The following analytic identifies the use of PowerShell downloading a file using * [[Documentation:ESSOC:stories:UseCase#HAFNIUM_Group|HAFNIUM Group]] +* [[Documentation:ESSOC:stories:UseCase#Ingress_Tool_Transfer|Ingress Tool Transfer]] + ====How To Implement==== To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. @@ -12612,6 +12695,182 @@ Administrators may modify the boot configuration. * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/atomic_red_team/windows-sysmon.log +''version'': 1 + + + +---- + +===Bits job persistence=== +The following query identifies Microsoft Background Intelligent Transfer Service utility `bitsadmin.exe` scheduling a BITS job to persist on an endpoint. The query identifies the parameters used to create, resume or add a file to a BITS job. Typically seen combined in a oneliner or ran in sequence. If identified, review the BITS job created and capture any files written to disk. It is possible for BITS to be used to upload files and this may require further network data analysis to identify. You can use `bitsadmin /list /verbose` to list out the jobs during investigation. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1197/ T1197] +* '''Last Updated''': 2021-03-29 + +
+
+ +====Search==== + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=bitsadmin.exe Processes.process IN (*create*, *addfile*, *setnotifyflags*, *setnotifycmdline*, *setminretrydelay*, *setcustomheaders*, *resume* ) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `bits_job_persistence_filter` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#BITS_Jobs|BITS Jobs]] + + +====How To Implement==== +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. + +====Required field==== + +* _time + +* Processes.process + +* Processes.parent_process + +* Processes.process_name + +* Processes.user + +* Processes.dest + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1197 +| BITS Jobs +| Defense Evasion, Persistence +|} + + +====Kill Chain Phase==== + +* Exploitation + + +====Known False Positives==== +Limited false positives will be present. Typically, applications will use `BitsAdmin.exe`. Any filtering should be done based on command-line arguments (legitimate applications) or parent process. + +====Reference==== + +* https://attack.mitre.org/techniques/T1197/ + +* https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/bitsadmin + +* https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1197/T1197.md#atomic-test-3---persist-download--execute + +* https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/ + + +====Test Dataset==== + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/windows-sysmon.log + + +''version'': 1 +
+
+ +---- + +===Bitsadmin download file=== +The following query identifies Microsoft Background Intelligent Transfer Service utility `bitsadmin.exe` using the `transfer` parameter to download a remote object. In addition, look for `download` or `upload` on the command-line, the switches are not required to perform a transfer. Capture any files downloaded. Review the reputation of the IP or domain used. Typically once executed, a follow on command will be used to execute the dropped file. Note that the network connection or file modification events related will not spawn or create from `bitsadmin.exe`, but the artifacts will appear in a parallel process of `svchost.exe` with a command-line similar to `svchost.exe -k netsvcs -s BITS`. It's important to review all parallel and child processes to capture any behaviors and artifacts. In some suspicious and malicious instances, BITS jobs will be created. You can use `bitsadmin /list /verbose` to list out the jobs during investigation. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1197/ T1197], [https://attack.mitre.org/techniques/T1105/ T1105] +* '''Last Updated''': 2021-03-26 + +
+
+ +====Search==== + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=bitsadmin.exe Processes.process=*transfer* by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `bitsadmin_download_file_filter` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Ingress_Tool_Transfer|Ingress Tool Transfer]] + +* [[Documentation:ESSOC:stories:UseCase#BITS_Jobs|BITS Jobs]] + + +====How To Implement==== +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. + +====Required field==== + +* _time + +* Processes.process + +* Processes.parent_process + +* Processes.process_name + +* Processes.user + +* Processes.dest + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1197 +| BITS Jobs +| Defense Evasion, Persistence +|- +| T1105 +| Ingress Tool Transfer +| Command and Control +|} + + +====Kill Chain Phase==== + +* Exploitation + + +====Known False Positives==== +Limited false positives, however it may be required to filter based on parent process name or network connection. + +====Reference==== + +* https://github.com/redcanaryco/atomic-red-team/blob/8eb52117b748d378325f7719554a896e37bccec7/atomics/T1105/T1105.md#atomic-test-9---windows---bitsadmin-bits-download + +* https://github.com/redcanaryco/atomic-red-team/blob/bc705cb7aaa5f26f2d96585fac8e4c7052df0ff9/atomics/T1197/T1197.md + +* https://docs.microsoft.com/en-us/windows/win32/bits/bitsadmin-tool + +* https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/ + + +====Test Dataset==== + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/windows-sysmon.log + + ''version'': 1
@@ -15057,6 +15316,94 @@ None identified. * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logPowerShellModule.log +''version'': 1 + + + +---- + +===Dsquery domain discovery=== +The following analytic identifies "dsquery.exe" execution with arguments looking for `TrustedDomain` query directly on the command-line. This is typically indicative of an Administrator or adversary perform domain trust discovery. Note that this query does not identify any other variations of "Dsquery.exe" usage.\ +Within this detection, it is assumed `dsquery.exe` is not moved or renamed.\ +The search will return the first time and last time these command-line arguments were used for these executions, as well as the target system, the user, process "dsquery.exe" and its parent process.\ +DSQuery.exe is natively found in `C:\Windows\system32` and `C:\Windows\syswow64` and only on Server operating system.\ +The following DLL(s) are loaded when DSQuery.exe is launched `dsquery.dll`. If found loaded by another process, it is possible dsquery is running within that process context in memory.\ +In addition to trust discovery, review parallel processes for additional behaviors performed. Identify the parent process and capture any files (batch files, for example) being used. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1482/ T1482] +* '''Last Updated''': 2021-03-31 + +
+
+ +====Search==== + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=dsquery.exe Processes.process=*trustedDomain* by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `dsquery_domain_discovery_filter` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Domain_Trust_Discovery|Domain Trust Discovery]] + + +====How To Implement==== +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. + +====Required field==== + +* _time + +* Processes.process_name + +* Processes.process + +* Processes.user + +* Processes.dest + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1482 +| Domain Trust Discovery +| Discovery +|} + + +====Kill Chain Phase==== + +* Exploitation + + +====Known False Positives==== +Limited false positives. If there is a true false positive, filter based on command-line or parent process. + +====Reference==== + +* https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1482/T1482.md + +* http://www.harmj0y.net/blog/redteaming/a-guide-to-attacking-domain-trusts/ + +* https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc732952(v=ws.11) + +* https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc754232(v=ws.11) + + +====Test Dataset==== + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1482/atomic_red_team/windows-sysmon.log + + ''version'': 1
@@ -16718,17 +17065,19 @@ The test data is converted from Windows Security Event logs generated from Attac ====Required field==== -* logon_process +* signature_id -* dest_user_primary_artifact +* authentication_type * _time -* event_code +* authentication_method -* dest_ip_primary_artifact +* origin_device_domain -* logon_type +* dest_user_id + +* dest_device_id @@ -18566,6 +18915,765 @@ While legitimate, these NirSoft tools are prone to abuse. You should verfiy that ---- +===Disable registry tool=== +This search is to identifies modification of registry to disable the regedit or registry tools of windows operating system. Since registry tool is a swiss knife in analyzing registry, malware such as RAT or trojan Spy disable this application to prevent the removal of their registry entry such as persistence, file less components and defense evasion. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1562.001/ T1562.001] +* '''Last Updated''': 2021-03-31 + +
+
+ +====Search==== + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableRegistryTools" Registry.registry_value_name = "DWORD (0x00000001)" by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest +| `drop_dm_object_name(Registry)` +| `security_content_ctime(firstTime)` +|`security_content_ctime(lastTime)` +| `disable_registry_tool_filter` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Windows_Defense_Evasion_Tactics|Windows Defense Evasion Tactics]] + + +====How To Implement==== +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. + +====Required field==== + +* _time + +* Registry.registry_key_name + +* Registry.registry_path + +* Registry.user + +* Registry.dest + +* Registry.registry_value_name + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1562.001 +| Disable or Modify Tools +| Defense Evasion +|} + + +====Kill Chain Phase==== + +* Exploitation + + +====Known False Positives==== +admin may disable this application for non technical user. + +====Reference==== + +* https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry + + +====Test Dataset==== + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log + + +''version'': 1 +
+
+ +---- + +===Disable show hidden files=== +The following search is to idetifies a modification in registry to prevent the user seeing all the files with hidden attributes. This event or techniques are known on some worm and trojan spy malware that will drop hidden files on the infected machine. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1564.001/ T1564.001], [https://attack.mitre.org/techniques/T1562.001/ T1562.001] +* '''Last Updated''': 2021-03-31 + +
+
+ +====Search==== + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\Hidden" OR Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\HideFileExt" Registry.registry_value_name = "DWORD (0x00000001)") OR (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowSuperHidden" Registry.registry_value_name = "DWORD (0x00000000)") by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest +| `drop_dm_object_name(Registry)` +| `security_content_ctime(firstTime)` +|`security_content_ctime(lastTime)` +| `disable_show_hidden_files_filter` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Windows_Defense_Evasion_Tactics|Windows Defense Evasion Tactics]] + + +====How To Implement==== +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. + +====Required field==== + +* _time + +* Registry.registry_key_name + +* Registry.registry_path + +* Registry.user + +* Registry.dest + +* Registry.registry_value_nam + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1564.001 +| Hidden Files and Directories +| Defense Evasion +|- +| T1562.001 +| Disable or Modify Tools +| Defense Evasion +|} + + +====Kill Chain Phase==== + +* Exploitation + + +====Known False Positives==== +unknown + +====Reference==== + +* https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Tiotua-P/detailed-analysis.aspx + + +====Test Dataset==== + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log + + +''version'': 1 +
+
+ +---- + +===Disable windows behavior monitoring=== +This search is to identifies a modification in registry to disable the windows denfender real time behavior monitoring. This event or technique is commonly seen in RAT, bot, or Trojan to disable AV to evade detections. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1562.001/ T1562.001] +* '''Last Updated''': 2021-03-31 + +
+
+ +====Search==== + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableBehaviorMonitoring" OR Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableOnAccessProtection" OR Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableScanOnRealtimeEnable" Registry.registry_value_name = "DWORD (0x00000001)" by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest +| `drop_dm_object_name(Registry)` +| `security_content_ctime(firstTime)` +|`security_content_ctime(lastTime)` +| `disable_windows_behavior_monitoring_filter` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Windows_Defense_Evasion_Tactics|Windows Defense Evasion Tactics]] + + +====How To Implement==== +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. + +====Required field==== + +* _time + +* Registry.registry_key_name + +* Registry.registry_path + +* Registry.user + +* Registry.dest + +* Registry.registry_value_name + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1562.001 +| Disable or Modify Tools +| Defense Evasion +|} + + +====Kill Chain Phase==== + +* Exploitation + + +====Known False Positives==== +admin or user may choose to disable this windows features. + +====Reference==== + +* https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html + + +====Test Dataset==== + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log + + +''version'': 1 +
+
+ +---- + +===Disable windows smartscreen protection=== +The following search identifies a modification of registry to disable the smartscreen protection of windows machine. This is windows feature provide an early warning system against website that might engage in phishing attack or malware distribution. This modification are seen in RAT malware to cover their tracks upon downloading other of its component or other payload. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1562.001/ T1562.001] +* '''Last Updated''': 2021-03-31 + +
+
+ +====Search==== + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SmartScreenEnabled" Registry.registry_value_name = "Off" by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest +| `drop_dm_object_name(Registry)` +| `security_content_ctime(firstTime)` +|`security_content_ctime(lastTime)` +| `disable_windows_smartscreen_protection_filter` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Windows_Defense_Evasion_Tactics|Windows Defense Evasion Tactics]] + + +====How To Implement==== +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. + +====Required field==== + +* _time + +* Registry.registry_key_name + +* Registry.registry_path + +* Registry.user + +* Registry.dest + +* Registry.registry_value_nam + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1562.001 +| Disable or Modify Tools +| Defense Evasion +|} + + +====Kill Chain Phase==== + +* Exploitation + + +====Known False Positives==== +admin or user may choose to disable this windows features. + +====Reference==== + +* https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html + + +====Test Dataset==== + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log + + +''version'': 1 +
+
+ +---- + +===Disabling cmd application=== +this search is to identify modification in registry to disable cmd prompt application. This technique is commonly seen in RAT, Trojan or WORM to prevent triaging or deleting there samples through cmd application which is one of the tool of analyst to traverse on directory and files. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1562.001/ T1562.001] +* '''Last Updated''': 2021-03-31 + +
+
+ +====Search==== + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\DisableCMD" Registry.registry_value_name = "DWORD (0x00000001)" by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest +| `drop_dm_object_name(Registry)` +| `security_content_ctime(firstTime)` +|`security_content_ctime(lastTime)` +| `disabling_cmd_application_filter` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Windows_Defense_Evasion_Tactics|Windows Defense Evasion Tactics]] + + +====How To Implement==== +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. + +====Required field==== + +* _time + +* Registry.registry_key_name + +* Registry.registry_path + +* Registry.user + +* Registry.dest + +* Registry.registry_value_name + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1562.001 +| Disable or Modify Tools +| Defense Evasion +|} + + +====Kill Chain Phase==== + +* Exploitation + + +====Known False Positives==== +admin may disable this application for non technical user. + +====Reference==== + +* https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry + + +====Test Dataset==== + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log + + +''version'': 1 +
+
+ +---- + +===Disabling controlpanel=== +this search is to identify registry modification to disable control panel window. This technique is commonly seen in malware to prevent their artifacts , persistence removed on the infected machine. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1562.001/ T1562.001] +* '''Last Updated''': 2021-03-31 + +
+
+ +====Search==== + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoControlPanel" Registry.registry_value_name = "DWORD (0x00000001)" by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest +| `drop_dm_object_name(Registry)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `disabling_controlpanel_filter` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Windows_Defense_Evasion_Tactics|Windows Defense Evasion Tactics]] + + +====How To Implement==== +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. + +====Required field==== + +* _time + +* Registry.registry_key_name + +* Registry.registry_path + +* Registry.user + +* Registry.dest + +* Registry.registry_value_name + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1562.001 +| Disable or Modify Tools +| Defense Evasion +|} + + +====Kill Chain Phase==== + +* Exploitation + + +====Known False Positives==== +admin may disable this application for non technical user. + +====Reference==== + +* https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry + + +====Test Dataset==== + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log + + +''version'': 1 +
+
+ +---- + +===Disabling firewall with netsh=== +This search is to identifies suspicious firewall disabling using netsh application. this technique is commonly seen in malware that tries to communicate or download its component or other payload to its C2 server. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1562.001/ T1562.001] +* '''Last Updated''': 2021-03-31 + +
+
+ +====Search==== + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=netsh.exe Processes.process= "*firewall*" (Processes.process= "*off*" OR Processes.process= "*disable*") by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `disabling_firewall_with_netsh_filter` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Windows_Defense_Evasion_Tactics|Windows Defense Evasion Tactics]] + + +====How To Implement==== +You must be ingesting data that records the filesystem activity from your hosts to populate the Endpoint file-system data model node. If you are using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which you want to collect data. + +====Required field==== + +* _time + +* Processes.process_name + +* Processes.process + +* Processes.dest + +* Processes.user + +* Processes.parent_process + +* Processes.process_name + +* Processes.process_id + +* Processes.parent_process_id + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1562.001 +| Disable or Modify Tools +| Defense Evasion +|} + + +====Kill Chain Phase==== + +* Exploitation + + +====Known False Positives==== +admin may disable firewall during testing or fixing network problem. + +====Reference==== + +* https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.htm + + +====Test Dataset==== + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log + + +''version'': 1 +
+
+ +---- + +===Disabling folderoptions windows feature=== +This search is to identify registry modification to disable folder options feature of windows to show hidden files, file extension and etc. This technique used by malware in combination if disabling show hidden files feature to hide their files and also to hide the file extension to lure the user base on file icons or fake file extensions. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1562.001/ T1562.001] +* '''Last Updated''': 2021-03-31 + +
+
+ +====Search==== + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoFolderOptions" Registry.registry_value_name = "DWORD (0x00000001)" by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest +| `drop_dm_object_name(Registry)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `disabling_folderoptions_windows_feature_filter` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Windows_Defense_Evasion_Tactics|Windows Defense Evasion Tactics]] + + +====How To Implement==== +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. + +====Required field==== + +* _time + +* Registry.registry_key_name + +* Registry.registry_path + +* Registry.user + +* Registry.dest + +* Registry.registry_value_name + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1562.001 +| Disable or Modify Tools +| Defense Evasion +|} + + +====Kill Chain Phase==== + +* Exploitation + + +====Known False Positives==== +admin may disable this application for non technical user. + +====Reference==== + +* https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry + + +====Test Dataset==== + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log + + +''version'': 1 +
+
+ +---- + +===Disabling norun windows app=== +This search is to identify modification of registry to disable run application in window start menu. this application is known to be a helpful shortcut to windows OS user to run known application and also to execute some reg or batch script. This technique is used malware to make cleaning of its infection more harder by preventing known application run easily through run shortcut. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1562.001/ T1562.001] +* '''Last Updated''': 2021-03-31 + +
+
+ +====Search==== + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoRun" Registry.registry_value_name = "DWORD (0x00000001)" by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest +| `drop_dm_object_name(Registry)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `disabling_norun_windows_app_filter` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Windows_Defense_Evasion_Tactics|Windows Defense Evasion Tactics]] + + +====How To Implement==== +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. + +====Required field==== + +* _time + +* Registry.registry_key_name + +* Registry.registry_path + +* Registry.user + +* Registry.dest + +* Registry.registry_value_name + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1562.001 +| Disable or Modify Tools +| Defense Evasion +|} + + +====Kill Chain Phase==== + +* Exploitation + + +====Known False Positives==== +admin may disable this application for non technical user. + +====Reference==== + +* https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry + +* https://blog.malwarebytes.com/detections/pum-optional-norun/ + + +====Test Dataset==== + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log + + +''version'': 1 +
+
+ +---- + ===Disabling remote user account control=== The search looks for modifications to registry keys that control the enforcement of Windows User Account Control (UAC). @@ -18645,6 +19753,174 @@ This registry key may be modified via administrators to implement a change in sy ---- +===Disabling systemrestore in registry=== +The following search identifies the modification of registry related in disabling the system restore of a machine. This event or behavior are seen in some RAT malware to make the restore of the infected machine difficult and keep their infection on the box. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1562.001/ T1562.001] +* '''Last Updated''': 2021-03-31 + +
+
+ +====Search==== + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SystemRestore\\DisableSR" OR Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SystemRestore\\DisableConfig" Registry.registry_value_name = "DWORD (0x00000001)" by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest +| `drop_dm_object_name(Registry)` +| `security_content_ctime(firstTime)` +|`security_content_ctime(lastTime)` +| `disabling_systemrestore_in_registry_filter` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Windows_Defense_Evasion_Tactics|Windows Defense Evasion Tactics]] + + +====How To Implement==== +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. + +====Required field==== + +* _time + +* Registry.registry_key_name + +* Registry.registry_path + +* Registry.user + +* Registry.dest + +* Registry.registry_value_name + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1562.001 +| Disable or Modify Tools +| Defense Evasion +|} + + +====Kill Chain Phase==== + +* Exploitation + + +====Known False Positives==== +in some cases admin can disable systemrestore on a machine. + +====Reference==== + +* https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html + + +====Test Dataset==== + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log + + +''version'': 1 +
+
+ +---- + +===Disabling task manager=== +This search is to identifies modification of registry to disable the task manager of windows operating system. this event or technique are commonly seen in malware such as RAT, Trojan, TrojanSpy or worm to prevent the user to terminate their process. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1562.001/ T1562.001] +* '''Last Updated''': 2021-03-31 + +
+
+ +====Search==== + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableTaskMgr" Registry.registry_value_name = "DWORD (0x00000001)" by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest +| `drop_dm_object_name(Registry)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `disabling_task_manager_filter` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Windows_Defense_Evasion_Tactics|Windows Defense Evasion Tactics]] + + +====How To Implement==== +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. + +====Required field==== + +* _time + +* Registry.registry_key_name + +* Registry.registry_path + +* Registry.user + +* Registry.dest + +* Registry.registry_value_name + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1562.001 +| Disable or Modify Tools +| Defense Evasion +|} + + +====Kill Chain Phase==== + +* Exploitation + + +====Known False Positives==== +admin may disable this application for non technical user. + +====Reference==== + +* https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry + +* https://blog.talosintelligence.com/2020/05/threat-roundup-0424-0501.html + + +====Test Dataset==== + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log + + +''version'': 1 +
+
+ +---- + ===Dump lsass via comsvcs dll=== Detect the usage of comsvcs.dll for dumping the lsass process. @@ -21037,6 +22313,101 @@ These characters might be legitimately on the command-line, but it is not common ---- +===Malicious powershell executed as a service=== +This detection is to identify the abuse the Windows SC.exe to execute malicious commands or payloads via PowerShell. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1569.002/ T1569.002] +* '''Last Updated''': 2021-04-07 + +
+
+ +====Search==== + `wineventlog_system` EventCode=7045 +| eval l_Service_File_Name=lower(Service_File_Name) +| regex l_Service_File_Name="powershell[.\s] +|powershell_ise[.\s] +|pwsh[.\s] +|psexec[.\s]" +| regex l_Service_File_Name="-nop[rofile]* +|-w[indowstyle]*\s+hid[den]* +|-noe[xit]* +|-enc[odedcommand]*" +| stats count min(_time) as firstTime max(_time) as lastTime by EventCode Service_File_Name Service_Name Service_Start_Type Service_Type Service_Account user +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `malicious_powershell_executed_as_a_service_filter` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Malicious_Powershell|Malicious Powershell]] + + +====How To Implement==== +To successfully implement this search, you need to be ingesting Windows System logs with the Service name, Service File Name Service Start type, and Service Type from your endpoints. + +====Required field==== + +* EventCode + +* Service_File_Name + +* Service_Type + +* _time + +* Service_Name + +* Service_Start_Type + +* Service_Account + +* user + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1569.002 +| Service Execution +| Execution +|} + + +====Kill Chain Phase==== + +* Privilege Escalation + + +====Known False Positives==== +Creating a hidden powershell service is rare and could key off of those instances. + +====Reference==== + +* https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/dosfuscation-report.pdf + +* http://az4n6.blogspot.com/2017/ + +* https://www.danielbohannon.com/blog-1/2017/3/12/powershell-execution-argument-obfuscation-how-it-can-make-detection-easier + + +====Test Dataset==== + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1569.002/atomic_red_team/windows-system.log + + +''version'': 1 +
+
+ +---- + ===Monitor registry keys for print monitors=== This search looks for registry activity associated with modifications to the registry key `HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors`. In this scenario, an attacker can load an arbitrary .dll into the print-monitor registry by giving the full path name to the after.dll. The system will execute the .dll with elevated (SYSTEM) permissions and will persist after reboot. @@ -21220,6 +22591,8 @@ This search looks for the execution of `nltest.exe` with command-line arguments * [[Documentation:ESSOC:stories:UseCase#Ryuk_Ransomware|Ryuk Ransomware]] +* [[Documentation:ESSOC:stories:UseCase#Domain_Trust_Discovery|Domain Trust Discovery]] + ====How To Implement==== To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. @@ -21551,6 +22924,87 @@ Microsoft may provide updates to these binaries. Verify that these changes do no ---- +===Powershell start-bitstransfer=== +Start-BitsTransfer is the PowerShell "version" of BitsAdmin.exe. Similar functionality is present. This technique variation is not as commonly used by adversaries, but has been abused in the past. Lesser known uses include the ability to set the `-TransferType` to `Upload` for exfiltration of files. In an instance where `Upload` is used, it is highly possible files will be archived. During triage, review parallel processes and process lineage. Capture any files on disk and review. For the remote domain or IP, what is the reputation? + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1197/ T1197] +* '''Last Updated''': 2021-03-29 + +
+
+ +====Search==== + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=powershell.exe Processes.process=*start-bitstransfer* by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `powershell_start_bitstransfer_filter` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#BITS_Jobs|BITS Jobs]] + + +====How To Implement==== +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. + +====Required field==== + +* _time + +* Processes.process + +* Processes.parent_process + +* Processes.process_name + +* Processes.user + +* Processes.dest + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1197 +| BITS Jobs +| Defense Evasion, Persistence +|} + + +====Kill Chain Phase==== + +* Exploitation + + +====Known False Positives==== +Limited false positives. It is possible administrators will utilize Start-BitsTransfer for administrative tasks, otherwise filter based parent process or command-line arguments. + +====Reference==== + +* https://isc.sans.edu/diary/Investigating+Microsoft+BITS+Activity/23281 + +* https://docs.microsoft.com/en-us/windows/win32/bits/using-windows-powershell-to-create-bits-transfer-jobs + + +====Test Dataset==== + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/windows-sysmon.log + + +''version'': 1 +
+
+ +---- + ===Probing access with stolen credentials via powersploit modules=== This detection identifies use of PowerSploit modules that facilitate access probing with admin credentials as well as probing access to system services. @@ -28671,6 +30125,8 @@ This search looks for the execution of `adfind.exe` with command-line arguments * [[Documentation:ESSOC:stories:UseCase#NOBELIUM_Group|NOBELIUM Group]] +* [[Documentation:ESSOC:stories:UseCase#Domain_Trust_Discovery|Domain Trust Discovery]] + ====How To Implement==== To successfully implement this search, you need to be ingesting logs with the process name, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. @@ -31671,7 +33127,7 @@ There might be false positives associted with this detection since items like ar ''#############'' ''# Automatically generated by doc_gen.py in https://github.com/splunk/security_content'' -''# On Date: 2021-04-02 17:10:21.330169 UTC'' +''# On Date: 2021-04-15 19:33:37.850083 UTC'' ''# Author: Splunk Security Research'' ''# Contact: research@splunk.com'' ''#############'' diff --git a/docs/mitre-map/coverage.csv b/docs/mitre-map/coverage.csv index ebbfc0318a..71510b3d79 100644 --- a/docs/mitre-map/coverage.csv +++ b/docs/mitre-map/coverage.csv @@ -138,7 +138,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -231,7 +231,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -424,8 +424,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -585,9 +586,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -678,8 +690,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -721,7 +733,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -748,8 +762,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -795,8 +809,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -811,8 +826,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -827,7 +843,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -844,7 +861,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -1050,7 +1068,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -1143,7 +1161,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -1336,8 +1354,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -1497,9 +1516,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -1590,8 +1620,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -1633,7 +1663,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -1660,8 +1692,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -1707,8 +1739,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -1723,8 +1756,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -1739,7 +1773,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -1756,7 +1791,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -1962,7 +1998,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -2055,7 +2091,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -2248,8 +2284,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -2409,9 +2446,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -2502,8 +2550,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -2545,7 +2593,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -2572,8 +2622,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -2619,8 +2669,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -2635,8 +2686,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -2651,7 +2703,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -2668,7 +2721,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -2874,7 +2928,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -2967,7 +3021,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -3160,8 +3214,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -3321,9 +3376,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -3414,8 +3480,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -3457,7 +3523,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -3484,8 +3552,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -3531,8 +3599,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -3547,8 +3616,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -3563,7 +3633,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -3580,7 +3651,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -3786,7 +3858,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -3879,7 +3951,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -4072,8 +4144,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -4233,9 +4306,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -4326,8 +4410,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -4369,7 +4453,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -4396,8 +4482,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -4443,8 +4529,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -4459,8 +4546,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -4475,7 +4563,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -4492,7 +4581,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -4698,7 +4788,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -4791,7 +4881,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -4984,8 +5074,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -5145,9 +5236,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -5238,8 +5340,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -5281,7 +5383,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -5308,8 +5412,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -5355,8 +5459,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -5371,8 +5476,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -5387,7 +5493,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -5404,7 +5511,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -5610,7 +5718,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -5703,7 +5811,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -5896,8 +6004,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -6057,9 +6166,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -6150,8 +6270,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -6193,7 +6313,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -6220,8 +6342,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -6267,8 +6389,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -6283,8 +6406,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -6299,7 +6423,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -6316,7 +6441,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -6522,7 +6648,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -6615,7 +6741,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -6808,8 +6934,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -6969,9 +7096,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -7062,8 +7200,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -7105,7 +7243,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -7132,8 +7272,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -7179,8 +7319,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -7195,8 +7336,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -7211,7 +7353,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -7228,7 +7371,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -7434,7 +7578,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -7527,7 +7671,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -7720,8 +7864,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -7881,9 +8026,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -7974,8 +8130,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -8017,7 +8173,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -8044,8 +8202,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -8091,8 +8249,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -8107,8 +8266,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -8123,7 +8283,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -8140,7 +8301,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -8346,7 +8508,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -8439,7 +8601,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -8632,8 +8794,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -8793,9 +8956,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -8886,8 +9060,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -8929,7 +9103,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -8956,8 +9132,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -9003,8 +9179,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -9019,8 +9196,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -9035,7 +9213,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -9052,7 +9231,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -9258,7 +9438,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -9351,7 +9531,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -9544,8 +9724,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -9705,9 +9886,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -9798,8 +9990,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -9841,7 +10033,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -9868,8 +10062,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -9915,8 +10109,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -9931,8 +10126,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -9947,7 +10143,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -9964,7 +10161,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -10170,7 +10368,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -10263,7 +10461,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -10456,8 +10654,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -10617,9 +10816,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -10710,8 +10920,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -10753,7 +10963,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -10780,8 +10992,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -10827,8 +11039,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -10843,8 +11056,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -10859,7 +11073,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -10876,7 +11091,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -11082,7 +11298,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -11175,7 +11391,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -11368,8 +11584,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -11529,9 +11746,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -11622,8 +11850,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -11665,7 +11893,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -11692,8 +11922,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -11739,8 +11969,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -11755,8 +11986,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -11771,7 +12003,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -11788,7 +12021,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -11994,7 +12228,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -12087,7 +12321,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -12280,8 +12514,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -12441,9 +12676,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -12534,8 +12780,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -12577,7 +12823,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -12604,8 +12852,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -12651,8 +12899,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -12667,8 +12916,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -12683,7 +12933,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -12700,7 +12951,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -12906,7 +13158,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -12999,7 +13251,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -13192,8 +13444,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -13353,9 +13606,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -13446,8 +13710,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -13489,7 +13753,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -13516,8 +13782,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -13563,8 +13829,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -13579,8 +13846,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -13595,7 +13863,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -13612,7 +13881,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -13818,7 +14088,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -13911,7 +14181,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -14104,8 +14374,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -14265,9 +14536,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -14358,8 +14640,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -14401,7 +14683,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -14428,8 +14712,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -14475,8 +14759,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -14491,8 +14776,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -14507,7 +14793,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -14524,7 +14811,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -14730,7 +15018,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -14823,7 +15111,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -15016,8 +15304,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -15177,9 +15466,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -15270,8 +15570,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -15313,7 +15613,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -15340,8 +15642,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -15387,8 +15689,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -15403,8 +15706,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -15419,7 +15723,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -15436,7 +15741,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -15642,7 +15948,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -15735,7 +16041,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -15928,8 +16234,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -16089,9 +16396,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -16182,8 +16500,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -16225,7 +16543,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -16252,8 +16572,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -16299,8 +16619,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -16315,8 +16636,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -16331,7 +16653,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -16348,7 +16671,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -16554,7 +16878,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -16647,7 +16971,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -16840,8 +17164,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -17001,9 +17326,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -17094,8 +17430,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -17137,7 +17473,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -17164,8 +17502,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -17211,8 +17549,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -17227,8 +17566,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -17243,7 +17583,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -17260,7 +17601,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -17466,7 +17808,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -17559,7 +17901,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -17752,8 +18094,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -17913,9 +18256,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -18006,8 +18360,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -18049,7 +18403,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -18076,8 +18432,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -18123,8 +18479,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -18139,8 +18496,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -18155,7 +18513,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -18172,7 +18531,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -18378,7 +18738,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -18471,7 +18831,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -18664,8 +19024,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -18825,9 +19186,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -18918,8 +19290,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -18961,7 +19333,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -18988,8 +19362,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -19035,8 +19409,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -19051,8 +19426,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -19067,7 +19443,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -19084,7 +19461,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -19290,7 +19668,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -19383,7 +19761,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -19576,8 +19954,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -19737,9 +20116,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -19830,8 +20220,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -19873,7 +20263,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -19900,8 +20292,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -19947,8 +20339,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -19963,8 +20356,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -19979,7 +20373,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -19996,7 +20391,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -20202,7 +20598,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -20295,7 +20691,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -20488,8 +20884,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -20649,9 +21046,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -20742,8 +21150,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -20785,7 +21193,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -20812,8 +21222,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -20859,8 +21269,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -20875,8 +21286,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -20891,7 +21303,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -20908,7 +21321,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -21114,7 +21528,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -21207,7 +21621,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -21400,8 +21814,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -21561,9 +21976,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -21654,8 +22080,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -21697,7 +22123,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -21724,8 +22152,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -21771,8 +22199,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -21787,8 +22216,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -21803,7 +22233,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -21820,7 +22251,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -22026,7 +22458,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -22119,7 +22551,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -22312,8 +22744,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -22473,9 +22906,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -22566,8 +23010,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -22609,7 +23053,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -22636,8 +23082,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -22683,8 +23129,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -22699,8 +23146,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -22715,7 +23163,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -22732,7 +23181,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -22938,7 +23388,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -23031,7 +23481,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -23224,8 +23674,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -23385,9 +23836,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -23478,8 +23940,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -23521,7 +23983,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -23548,8 +24012,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -23595,8 +24059,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -23611,8 +24076,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -23627,7 +24093,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -23644,7 +24111,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -23850,7 +24318,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -23943,7 +24411,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -24136,8 +24604,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -24297,9 +24766,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -24390,8 +24870,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -24433,7 +24913,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -24460,8 +24942,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -24507,8 +24989,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -24523,8 +25006,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -24539,7 +25023,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -24556,7 +25041,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -24762,7 +25248,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -24855,7 +25341,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -25048,8 +25534,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -25209,9 +25696,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -25302,8 +25800,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -25345,7 +25843,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -25372,8 +25872,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -25419,8 +25919,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -25435,8 +25936,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -25451,7 +25953,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -25468,7 +25971,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -25674,7 +26178,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -25767,7 +26271,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -25960,8 +26464,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -26121,9 +26626,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -26214,8 +26730,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -26257,7 +26773,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -26284,8 +26802,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -26331,8 +26849,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -26347,8 +26866,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -26363,7 +26883,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -26380,7 +26901,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -26586,7 +27108,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -26679,7 +27201,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -26872,8 +27394,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -27033,9 +27556,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -27126,8 +27660,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -27169,7 +27703,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -27196,8 +27732,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -27243,8 +27779,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -27259,8 +27796,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -27275,7 +27813,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -27292,7 +27831,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -27498,7 +28038,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -27591,7 +28131,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -27784,8 +28324,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -27945,9 +28486,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -28038,8 +28590,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -28081,7 +28633,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -28108,8 +28662,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -28155,8 +28709,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -28171,8 +28726,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -28187,7 +28743,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -28204,7 +28761,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -28410,7 +28968,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -28503,7 +29061,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -28696,8 +29254,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -28857,9 +29416,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -28950,8 +29520,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -28993,7 +29563,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -29020,8 +29592,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -29067,8 +29639,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -29083,8 +29656,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -29099,7 +29673,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -29116,7 +29691,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -29322,7 +29898,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -29415,7 +29991,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -29608,8 +30184,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -29769,9 +30346,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -29862,8 +30450,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -29905,7 +30493,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -29932,8 +30522,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -29979,8 +30569,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -29995,8 +30586,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -30011,7 +30603,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -30028,7 +30621,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -30234,7 +30828,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -30327,7 +30921,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -30520,8 +31114,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -30681,9 +31276,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -30774,8 +31380,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -30817,7 +31423,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -30844,8 +31452,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -30891,8 +31499,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -30907,8 +31516,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -30923,7 +31533,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -30940,7 +31551,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -31146,7 +31758,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -31239,7 +31851,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -31432,8 +32044,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -31593,9 +32206,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -31686,8 +32310,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -31729,7 +32353,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -31756,8 +32382,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -31803,8 +32429,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -31819,8 +32446,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -31835,7 +32463,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -31852,7 +32481,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -32058,7 +32688,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -32151,7 +32781,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -32344,8 +32974,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -32505,9 +33136,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -32598,8 +33240,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -32641,7 +33283,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -32668,8 +33312,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -32715,8 +33359,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -32731,8 +33376,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -32747,7 +33393,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -32764,7 +33411,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -32970,7 +33618,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -33063,7 +33711,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -33256,8 +33904,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -33417,9 +34066,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -33510,8 +34170,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -33553,7 +34213,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -33580,8 +34242,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -33627,8 +34289,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -33643,8 +34306,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -33659,7 +34323,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -33676,7 +34341,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -33882,7 +34548,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -33975,7 +34641,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -34168,8 +34834,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -34329,9 +34996,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -34422,8 +35100,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -34465,7 +35143,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -34492,8 +35172,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -34539,8 +35219,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -34555,8 +35236,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -34571,7 +35253,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -34588,7 +35271,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -34794,7 +35478,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -34887,7 +35571,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -35080,8 +35764,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -35241,9 +35926,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -35334,8 +36030,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -35377,7 +36073,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -35404,8 +36102,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -35451,8 +36149,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -35467,8 +36166,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -35483,7 +36183,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -35500,7 +36201,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -35706,7 +36408,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -35799,7 +36501,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -35992,8 +36694,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -36153,9 +36856,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -36246,8 +36960,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -36289,7 +37003,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -36316,8 +37032,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -36363,8 +37079,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -36379,8 +37096,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -36395,7 +37113,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -36412,7 +37131,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -36618,7 +37338,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -36711,7 +37431,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -36904,8 +37624,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -37065,9 +37786,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -37158,8 +37890,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -37201,7 +37933,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -37228,8 +37962,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -37275,8 +38009,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -37291,8 +38026,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -37307,7 +38043,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -37324,7 +38061,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -37530,7 +38268,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -37623,7 +38361,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -37816,8 +38554,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -37977,9 +38716,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -38070,8 +38820,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -38113,7 +38863,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -38140,8 +38892,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -38187,8 +38939,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -38203,8 +38956,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -38219,7 +38973,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -38236,7 +38991,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -38442,7 +39198,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -38535,7 +39291,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -38728,8 +39484,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -38889,9 +39646,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -38982,8 +39750,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -39025,7 +39793,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -39052,8 +39822,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -39099,8 +39869,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -39115,8 +39886,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -39131,7 +39903,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -39148,7 +39921,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -39354,7 +40128,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -39447,7 +40221,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -39640,8 +40414,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -39801,9 +40576,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -39894,8 +40680,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -39937,7 +40723,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -39964,8 +40752,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -40011,8 +40799,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -40027,8 +40816,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -40043,7 +40833,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -40060,7 +40851,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -40266,7 +41058,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -40359,7 +41151,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -40552,8 +41344,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -40713,9 +41506,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -40806,8 +41610,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -40849,7 +41653,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -40876,8 +41682,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -40923,8 +41729,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -40939,8 +41746,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -40955,7 +41763,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -40972,7 +41781,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -41178,7 +41988,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -41271,7 +42081,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -41464,8 +42274,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -41625,9 +42436,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -41718,8 +42540,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -41761,7 +42583,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -41788,8 +42612,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -41835,8 +42659,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -41851,8 +42676,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -41867,7 +42693,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -41884,7 +42711,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -42090,7 +42918,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -42183,7 +43011,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -42376,8 +43204,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -42537,9 +43366,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -42630,8 +43470,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -42673,7 +43513,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -42700,8 +43542,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -42747,8 +43589,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -42763,8 +43606,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -42779,7 +43623,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -42796,7 +43641,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -43002,7 +43848,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -43095,7 +43941,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -43288,8 +44134,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -43449,9 +44296,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -43542,8 +44400,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -43585,7 +44443,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -43612,8 +44472,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -43659,8 +44519,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -43675,8 +44536,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -43691,7 +44553,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -43708,7 +44571,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -43914,7 +44778,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -44007,7 +44871,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -44200,8 +45064,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -44361,9 +45226,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -44454,8 +45330,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -44497,7 +45373,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -44524,8 +45402,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -44571,8 +45449,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -44587,8 +45466,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -44603,7 +45483,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -44620,7 +45501,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -44826,7 +45708,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -44919,7 +45801,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -45112,8 +45994,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -45273,9 +46156,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -45366,8 +46260,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -45409,7 +46303,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -45436,8 +46332,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -45483,8 +46379,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -45499,8 +46396,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -45515,7 +46413,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -45532,7 +46431,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -45738,7 +46638,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -45831,7 +46731,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -46024,8 +46924,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -46185,9 +47086,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -46278,8 +47190,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -46321,7 +47233,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -46348,8 +47262,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -46395,8 +47309,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -46411,8 +47326,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -46427,7 +47343,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -46444,7 +47361,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -46650,7 +47568,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -46743,7 +47661,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -46936,8 +47854,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -47097,9 +48016,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -47190,8 +48120,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -47233,7 +48163,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -47260,8 +48192,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -47307,8 +48239,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -47323,8 +48256,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -47339,7 +48273,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -47356,7 +48291,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -47562,7 +48498,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -47655,7 +48591,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -47848,8 +48784,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -48009,9 +48946,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -48102,8 +49050,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -48145,7 +49093,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -48172,8 +49122,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -48219,8 +49169,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -48235,8 +49186,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -48251,7 +49203,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -48268,7 +49221,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -48474,7 +49428,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -48567,7 +49521,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -48760,8 +49714,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -48921,9 +49876,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -49014,8 +49980,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -49057,7 +50023,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -49084,8 +50052,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -49131,8 +50099,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -49147,8 +50116,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -49163,7 +50133,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -49180,7 +50151,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -49386,7 +50358,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -49479,7 +50451,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -49672,8 +50644,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -49833,9 +50806,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -49926,8 +50910,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -49969,7 +50953,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -49996,8 +50982,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -50043,8 +51029,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -50059,8 +51046,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -50075,7 +51063,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -50092,7 +51081,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -50298,7 +51288,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -50391,7 +51381,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -50584,8 +51574,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -50745,9 +51736,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -50838,8 +51840,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -50881,7 +51883,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -50908,8 +51912,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -50955,8 +51959,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -50971,8 +51976,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -50987,7 +51993,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -51004,7 +52011,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -51210,7 +52218,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -51303,7 +52311,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -51496,8 +52504,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -51657,9 +52666,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -51750,8 +52770,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -51793,7 +52813,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -51820,8 +52842,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -51867,8 +52889,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -51883,8 +52906,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -51899,7 +52923,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -51916,7 +52941,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -52122,7 +53148,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -52215,7 +53241,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -52408,8 +53434,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -52569,9 +53596,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -52662,8 +53700,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -52705,7 +53743,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -52732,8 +53772,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -52779,8 +53819,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -52795,8 +53836,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -52811,7 +53853,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -52828,7 +53871,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -53034,7 +54078,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -53127,7 +54171,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -53320,8 +54364,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -53481,9 +54526,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -53574,8 +54630,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -53617,7 +54673,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -53644,8 +54702,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -53691,8 +54749,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -53707,8 +54766,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -53723,7 +54783,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -53740,7 +54801,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -53946,7 +55008,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -54039,7 +55101,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -54232,8 +55294,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -54393,9 +55456,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -54486,8 +55560,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -54529,7 +55603,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -54556,8 +55632,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -54603,8 +55679,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -54619,8 +55696,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -54635,7 +55713,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -54652,7 +55731,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -54858,7 +55938,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -54951,7 +56031,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -55144,8 +56224,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -55305,9 +56386,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -55398,8 +56490,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -55441,7 +56533,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -55468,8 +56562,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -55515,8 +56609,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -55531,8 +56626,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -55547,7 +56643,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -55564,7 +56661,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -55770,7 +56868,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -55863,7 +56961,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -56056,8 +57154,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -56217,9 +57316,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -56310,8 +57420,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -56353,7 +57463,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -56380,8 +57492,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -56427,8 +57539,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -56443,8 +57556,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -56459,7 +57573,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -56476,7 +57591,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -56682,7 +57798,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -56775,7 +57891,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -56968,8 +58084,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -57129,9 +58246,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -57222,8 +58350,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -57265,7 +58393,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -57292,8 +58422,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -57339,8 +58469,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -57355,8 +58486,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -57371,7 +58503,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -57388,7 +58521,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -57594,7 +58728,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -57687,7 +58821,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -57880,8 +59014,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -58041,9 +59176,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -58134,8 +59280,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -58177,7 +59323,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -58204,8 +59352,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -58251,8 +59399,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -58267,8 +59416,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -58283,7 +59433,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -58300,7 +59451,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -58506,7 +59658,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -58599,7 +59751,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -58792,8 +59944,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -58953,9 +60106,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -59046,8 +60210,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -59089,7 +60253,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -59116,8 +60282,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -59163,8 +60329,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -59179,8 +60346,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -59195,7 +60363,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -59212,7 +60381,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -59418,7 +60588,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -59511,7 +60681,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -59704,8 +60874,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -59865,9 +61036,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -59958,8 +61140,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -60001,7 +61183,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -60028,8 +61212,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -60075,8 +61259,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -60091,8 +61276,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -60107,7 +61293,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -60124,7 +61311,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -60330,7 +61518,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -60423,7 +61611,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -60616,8 +61804,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -60777,9 +61966,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -60870,8 +62070,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -60913,7 +62113,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -60940,8 +62142,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -60987,8 +62189,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -61003,8 +62206,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -61019,7 +62223,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -61036,7 +62241,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -61242,7 +62448,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -61335,7 +62541,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -61528,8 +62734,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -61689,9 +62896,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -61782,8 +63000,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -61825,7 +63043,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -61852,8 +63072,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -61899,8 +63119,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -61915,8 +63136,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -61931,7 +63153,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -61948,7 +63171,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -62154,7 +63378,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -62247,7 +63471,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -62440,8 +63664,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -62601,9 +63826,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -62694,8 +63930,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -62737,7 +63973,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -62764,8 +64002,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -62811,8 +64049,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -62827,8 +64066,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -62843,7 +64083,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -62860,7 +64101,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -63066,7 +64308,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -63159,7 +64401,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -63352,8 +64594,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -63513,9 +64756,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -63606,8 +64860,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -63649,7 +64903,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -63676,8 +64932,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -63723,8 +64979,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -63739,8 +64996,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -63755,7 +65013,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -63772,7 +65031,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -63978,7 +65238,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -64071,7 +65331,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -64264,8 +65524,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -64425,9 +65686,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -64518,8 +65790,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -64561,7 +65833,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -64588,8 +65862,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -64635,8 +65909,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -64651,8 +65926,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -64667,7 +65943,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -64684,7 +65961,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -64890,7 +66168,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -64983,7 +66261,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -65176,8 +66454,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -65337,9 +66616,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -65430,8 +66720,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -65473,7 +66763,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -65500,8 +66792,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -65547,8 +66839,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -65563,8 +66856,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -65579,7 +66873,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -65596,7 +66891,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -65802,7 +67098,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -65895,7 +67191,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -66088,8 +67384,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -66249,9 +67546,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -66342,8 +67650,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -66385,7 +67693,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -66412,8 +67722,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -66459,8 +67769,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -66475,8 +67786,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -66491,7 +67803,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -66508,7 +67821,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -66714,7 +68028,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -66807,7 +68121,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -67000,8 +68314,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -67161,9 +68476,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -67254,8 +68580,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -67297,7 +68623,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -67324,8 +68652,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -67371,8 +68699,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -67387,8 +68716,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -67403,7 +68733,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -67420,7 +68751,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -67626,7 +68958,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -67719,7 +69051,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -67912,8 +69244,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -68073,9 +69406,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -68166,8 +69510,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -68209,7 +69553,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -68236,8 +69582,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -68283,8 +69629,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -68299,8 +69646,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -68315,7 +69663,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -68332,7 +69681,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -68538,7 +69888,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -68631,7 +69981,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -68824,8 +70174,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -68985,9 +70336,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -69078,8 +70440,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -69121,7 +70483,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -69148,8 +70512,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -69195,8 +70559,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -69211,8 +70576,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -69227,7 +70593,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -69244,7 +70611,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -69450,7 +70818,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -69543,7 +70911,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -69736,8 +71104,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -69897,9 +71266,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -69990,8 +71370,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -70033,7 +71413,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -70060,8 +71442,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -70107,8 +71489,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -70123,8 +71506,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -70139,7 +71523,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -70156,7 +71541,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -70362,7 +71748,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -70455,7 +71841,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -70648,8 +72034,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -70809,9 +72196,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -70902,8 +72300,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -70945,7 +72343,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -70972,8 +72372,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -71019,8 +72419,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -71035,8 +72436,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -71051,7 +72453,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -71068,7 +72471,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -71274,7 +72678,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -71367,7 +72771,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -71560,8 +72964,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -71721,9 +73126,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -71814,8 +73230,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -71857,7 +73273,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -71884,8 +73302,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -71931,8 +73349,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -71947,8 +73366,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -71963,7 +73383,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -71980,7 +73401,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -72186,7 +73608,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -72279,7 +73701,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -72472,8 +73894,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -72633,9 +74056,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -72726,8 +74160,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -72769,7 +74203,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -72796,8 +74232,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -72843,8 +74279,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -72859,8 +74296,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -72875,7 +74313,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -72892,7 +74331,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -73098,7 +74538,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -73191,7 +74631,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -73384,8 +74824,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -73545,9 +74986,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -73638,8 +75090,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -73681,7 +75133,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -73708,8 +75162,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -73755,8 +75209,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -73771,8 +75226,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -73787,7 +75243,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -73804,7 +75261,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -74010,7 +75468,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -74103,7 +75561,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -74296,8 +75754,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -74457,9 +75916,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -74550,8 +76020,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -74593,7 +76063,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -74620,8 +76092,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -74667,8 +76139,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -74683,8 +76156,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -74699,7 +76173,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -74716,7 +76191,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -74922,7 +76398,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -75015,7 +76491,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -75208,8 +76684,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -75369,9 +76846,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -75462,8 +76950,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -75505,7 +76993,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -75532,8 +77022,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -75579,8 +77069,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -75595,8 +77086,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -75611,7 +77103,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -75628,7 +77121,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -75834,7 +77328,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -75927,7 +77421,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -76120,8 +77614,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -76281,9 +77776,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -76374,8 +77880,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -76417,7 +77923,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -76444,8 +77952,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -76491,8 +77999,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -76507,8 +78016,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -76523,7 +78033,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -76540,7 +78051,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -76746,7 +78258,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -76839,7 +78351,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -77032,8 +78544,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -77193,9 +78706,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -77286,8 +78810,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -77329,7 +78853,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -77356,8 +78882,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -77403,8 +78929,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -77419,8 +78946,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -77435,7 +78963,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -77452,7 +78981,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -77658,7 +79188,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -77751,7 +79281,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -77944,8 +79474,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -78105,9 +79636,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -78198,8 +79740,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -78241,7 +79783,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -78268,8 +79812,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -78315,8 +79859,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -78331,8 +79876,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -78347,7 +79893,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -78364,7 +79911,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -78570,7 +80118,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -78663,7 +80211,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -78856,8 +80404,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -79017,9 +80566,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -79110,8 +80670,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -79153,7 +80713,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -79180,8 +80742,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -79227,8 +80789,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -79243,8 +80806,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -79259,7 +80823,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -79276,7 +80841,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -79482,7 +81048,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -79575,7 +81141,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -79768,8 +81334,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -79929,9 +81496,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -80022,8 +81600,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -80065,7 +81643,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -80092,8 +81672,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -80139,8 +81719,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -80155,8 +81736,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -80171,7 +81753,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -80188,7 +81771,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -80394,7 +81978,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -80487,7 +82071,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -80680,8 +82264,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -80841,9 +82426,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -80934,8 +82530,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -80977,7 +82573,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -81004,8 +82602,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -81051,8 +82649,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -81067,8 +82666,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -81083,7 +82683,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -81100,7 +82701,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -81306,7 +82908,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -81399,7 +83001,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -81592,8 +83194,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -81753,9 +83356,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -81846,8 +83460,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -81889,7 +83503,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -81916,8 +83532,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -81963,8 +83579,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -81979,8 +83596,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -81995,7 +83613,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -82012,7 +83631,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -82218,7 +83838,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -82311,7 +83931,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -82504,8 +84124,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -82665,9 +84286,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -82758,8 +84390,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -82801,7 +84433,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -82828,8 +84462,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -82875,8 +84509,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -82891,8 +84526,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -82907,7 +84543,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -82924,7 +84561,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -83130,7 +84768,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -83223,7 +84861,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -83416,8 +85054,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -83577,9 +85216,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -83670,8 +85320,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -83713,7 +85363,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -83740,8 +85392,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -83787,8 +85439,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -83803,8 +85456,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -83819,7 +85473,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -83836,7 +85491,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -84042,7 +85698,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -84135,7 +85791,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -84328,8 +85984,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -84489,9 +86146,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -84582,8 +86250,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -84625,7 +86293,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -84652,8 +86322,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -84699,8 +86369,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -84715,8 +86386,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -84731,7 +86403,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -84748,7 +86421,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -84954,7 +86628,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -85047,7 +86721,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -85240,8 +86914,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -85401,9 +87076,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -85494,8 +87180,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -85537,7 +87223,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -85564,8 +87252,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -85611,8 +87299,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -85627,8 +87316,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -85643,7 +87333,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -85660,7 +87351,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -85866,7 +87558,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -85959,7 +87651,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -86152,8 +87844,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -86313,9 +88006,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -86406,8 +88110,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -86449,7 +88153,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -86476,8 +88182,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -86523,8 +88229,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -86539,8 +88246,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -86555,7 +88263,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -86572,7 +88281,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -86778,7 +88488,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -86871,7 +88581,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -87064,8 +88774,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -87225,9 +88936,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -87318,8 +89040,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -87361,7 +89083,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -87388,8 +89112,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -87435,8 +89159,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -87451,8 +89176,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -87467,7 +89193,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -87484,7 +89211,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -87690,7 +89418,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -87783,7 +89511,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -87976,8 +89704,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -88137,9 +89866,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -88230,8 +89970,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -88273,7 +90013,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -88300,8 +90042,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -88347,8 +90089,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -88363,8 +90106,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -88379,7 +90123,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -88396,7 +90141,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -88602,7 +90348,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -88695,7 +90441,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -88888,8 +90634,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -89049,9 +90796,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -89142,8 +90900,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -89185,7 +90943,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -89212,8 +90972,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -89259,8 +91019,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -89275,8 +91036,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -89291,7 +91053,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -89308,7 +91071,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -89514,7 +91278,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -89607,7 +91371,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -89800,8 +91564,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -89961,9 +91726,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -90054,8 +91830,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -90097,7 +91873,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -90124,8 +91902,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -90171,8 +91949,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -90187,8 +91966,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -90203,7 +91983,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -90220,7 +92001,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -90426,7 +92208,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -90519,7 +92301,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -90712,8 +92494,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -90873,9 +92656,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -90966,8 +92760,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -91009,7 +92803,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -91036,8 +92832,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -91083,8 +92879,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -91099,8 +92896,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -91115,7 +92913,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -91132,7 +92931,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -91338,7 +93138,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -91431,7 +93231,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -91624,8 +93424,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -91785,9 +93586,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -91878,8 +93690,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -91921,7 +93733,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -91948,8 +93762,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -91995,8 +93809,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -92011,8 +93826,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -92027,7 +93843,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -92044,7 +93861,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -92250,7 +94068,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -92343,7 +94161,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -92536,8 +94354,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -92697,9 +94516,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -92790,8 +94620,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -92833,7 +94663,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -92860,8 +94692,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -92907,8 +94739,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -92923,8 +94756,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -92939,7 +94773,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -92956,7 +94791,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -93162,7 +94998,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -93255,7 +95091,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -93448,8 +95284,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -93609,9 +95446,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -93702,8 +95550,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -93745,7 +95593,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -93772,8 +95622,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -93819,8 +95669,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -93835,8 +95686,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -93851,7 +95703,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -93868,7 +95721,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -94074,7 +95928,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -94167,7 +96021,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -94360,8 +96214,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -94521,9 +96376,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -94614,8 +96480,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -94657,7 +96523,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -94684,8 +96552,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -94731,8 +96599,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -94747,8 +96616,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -94763,7 +96633,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -94780,7 +96651,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -94986,7 +96858,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -95079,7 +96951,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -95272,8 +97144,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -95433,9 +97306,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -95526,8 +97410,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -95569,7 +97453,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -95596,8 +97482,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -95643,8 +97529,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -95659,8 +97546,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -95675,7 +97563,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -95692,7 +97581,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -95898,7 +97788,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -95991,7 +97881,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -96184,8 +98074,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -96345,9 +98236,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -96438,8 +98340,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -96481,7 +98383,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -96508,8 +98412,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -96555,8 +98459,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -96571,8 +98476,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -96587,7 +98493,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -96604,7 +98511,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -96810,7 +98718,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -96903,7 +98811,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -97096,8 +99004,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -97257,9 +99166,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -97350,8 +99270,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -97393,7 +99313,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -97420,8 +99342,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -97467,8 +99389,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -97483,8 +99406,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -97499,7 +99423,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -97516,7 +99441,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -97722,7 +99648,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -97815,7 +99741,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -98008,8 +99934,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -98169,9 +100096,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -98262,8 +100200,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -98305,7 +100243,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -98332,8 +100272,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -98379,8 +100319,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -98395,8 +100336,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -98411,7 +100353,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -98428,7 +100371,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -98634,7 +100578,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -98727,7 +100671,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -98920,8 +100864,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -99081,9 +101026,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -99174,8 +101130,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -99217,7 +101173,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -99244,8 +101202,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -99291,8 +101249,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -99307,8 +101266,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -99323,7 +101283,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -99340,7 +101301,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -99546,7 +101508,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -99639,7 +101601,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -99832,8 +101794,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -99993,9 +101956,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -100086,8 +102060,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -100129,7 +102103,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -100156,8 +102132,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -100203,8 +102179,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -100219,8 +102196,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -100235,7 +102213,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -100252,7 +102231,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -100458,7 +102438,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -100551,7 +102531,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -100744,8 +102724,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -100905,9 +102886,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -100998,8 +102990,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -101041,7 +103033,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -101068,8 +103062,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -101115,8 +103109,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -101131,8 +103126,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -101147,7 +103143,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -101164,7 +103161,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -101370,7 +103368,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -101463,7 +103461,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -101656,8 +103654,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -101817,9 +103816,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -101910,8 +103920,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -101953,7 +103963,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -101980,8 +103992,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -102027,8 +104039,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -102043,8 +104056,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -102059,7 +104073,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -102076,7 +104091,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -102282,7 +104298,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -102375,7 +104391,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -102568,8 +104584,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -102729,9 +104746,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -102822,8 +104850,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -102865,7 +104893,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -102892,8 +104922,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -102939,8 +104969,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -102955,8 +104986,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -102971,7 +105003,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -102988,7 +105021,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -103194,7 +105228,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -103287,7 +105321,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -103480,8 +105514,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -103641,9 +105676,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -103734,8 +105780,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -103777,7 +105823,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -103804,8 +105852,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -103851,8 +105899,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -103867,8 +105916,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -103883,7 +105933,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -103900,7 +105951,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -104106,7 +106158,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -104199,7 +106251,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -104392,8 +106444,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -104553,9 +106606,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -104646,8 +106710,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -104689,7 +106753,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -104716,8 +106782,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -104763,8 +106829,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -104779,8 +106846,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -104795,7 +106863,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -104812,7 +106881,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -105018,7 +107088,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -105111,7 +107181,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -105304,8 +107374,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -105465,9 +107536,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -105558,8 +107640,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -105601,7 +107683,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -105628,8 +107712,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -105675,8 +107759,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -105691,8 +107776,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -105707,7 +107793,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -105724,7 +107811,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -105930,7 +108018,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -106023,7 +108111,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -106216,8 +108304,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -106377,9 +108466,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -106470,8 +108570,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -106513,7 +108613,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -106540,8 +108642,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -106587,8 +108689,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -106603,8 +108706,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -106619,7 +108723,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -106636,7 +108741,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -106842,7 +108948,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -106935,7 +109041,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -107128,8 +109234,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -107289,9 +109396,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -107382,8 +109500,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -107425,7 +109543,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -107452,8 +109572,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -107499,8 +109619,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -107515,8 +109636,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -107531,7 +109653,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -107548,7 +109671,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -107754,7 +109878,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -107847,7 +109971,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -108040,8 +110164,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -108201,9 +110326,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -108294,8 +110430,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -108337,7 +110473,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -108364,8 +110502,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -108411,8 +110549,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -108427,8 +110566,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -108443,7 +110583,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -108460,7 +110601,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -108666,7 +110808,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -108759,7 +110901,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -108952,8 +111094,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -109113,9 +111256,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -109206,8 +111360,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -109249,7 +111403,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -109276,8 +111432,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -109323,8 +111479,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -109339,8 +111496,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -109355,7 +111513,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -109372,7 +111531,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -109578,7 +111738,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -109671,7 +111831,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -109864,8 +112024,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -110025,9 +112186,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -110118,8 +112290,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -110161,7 +112333,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -110188,8 +112362,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -110235,8 +112409,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -110251,8 +112426,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -110267,7 +112443,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -110284,7 +112461,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -110490,7 +112668,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -110583,7 +112761,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -110776,8 +112954,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -110937,9 +113116,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -111030,8 +113220,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -111073,7 +113263,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -111100,8 +113292,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -111147,8 +113339,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -111163,8 +113356,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -111179,7 +113373,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -111196,7 +113391,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -111402,7 +113598,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -111495,7 +113691,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -111688,8 +113884,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -111849,9 +114046,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -111942,8 +114150,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -111985,7 +114193,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -112012,8 +114222,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -112059,8 +114269,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -112075,8 +114286,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -112091,7 +114303,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -112108,7 +114321,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -112314,7 +114528,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -112407,7 +114621,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -112600,8 +114814,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -112761,9 +114976,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -112854,8 +115080,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -112897,7 +115123,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -112924,8 +115152,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -112971,8 +115199,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -112987,8 +115216,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -113003,7 +115233,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -113020,7 +115251,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -113226,7 +115458,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -113319,7 +115551,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -113512,8 +115744,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -113673,9 +115906,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -113766,8 +116010,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -113809,7 +116053,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -113836,8 +116082,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -113883,8 +116129,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -113899,8 +116146,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -113915,7 +116163,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -113932,7 +116181,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -114138,7 +116388,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -114231,7 +116481,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -114424,8 +116674,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -114585,9 +116836,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -114678,8 +116940,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -114721,7 +116983,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -114748,8 +117012,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -114795,8 +117059,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -114811,8 +117076,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -114827,7 +117093,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -114844,7 +117111,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -115050,7 +117318,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -115143,7 +117411,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -115336,8 +117604,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -115497,9 +117766,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -115590,8 +117870,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -115633,7 +117913,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -115660,8 +117942,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -115707,8 +117989,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -115723,8 +118006,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -115739,7 +118023,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -115756,7 +118041,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -115962,7 +118248,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -116055,7 +118341,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -116248,8 +118534,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -116409,9 +118696,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -116502,8 +118800,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -116545,7 +118843,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -116572,8 +118872,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -116619,8 +118919,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -116635,8 +118936,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -116651,7 +118953,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -116668,7 +118971,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -116874,7 +119178,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -116967,7 +119271,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -117160,8 +119464,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -117321,9 +119626,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -117414,8 +119730,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -117457,7 +119773,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -117484,8 +119802,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -117531,8 +119849,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -117547,8 +119866,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -117563,7 +119883,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -117580,7 +119901,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -117786,7 +120108,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -117879,7 +120201,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -118072,8 +120394,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -118233,9 +120556,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -118326,8 +120660,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -118369,7 +120703,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -118396,8 +120732,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -118443,8 +120779,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -118459,8 +120796,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -118475,7 +120813,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -118492,7 +120831,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -118698,7 +121038,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -118791,7 +121131,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -118984,8 +121324,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -119145,9 +121486,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -119238,8 +121590,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -119281,7 +121633,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -119308,8 +121662,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -119355,8 +121709,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -119371,8 +121726,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -119387,7 +121743,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -119404,7 +121761,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -119610,7 +121968,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -119703,7 +122061,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -119896,8 +122254,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -120057,9 +122416,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -120150,8 +122520,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -120193,7 +122563,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -120220,8 +122592,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -120267,8 +122639,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -120283,8 +122656,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -120299,7 +122673,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -120316,7 +122691,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -120522,7 +122898,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -120615,7 +122991,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -120808,8 +123184,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -120969,9 +123346,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -121062,8 +123450,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -121105,7 +123493,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -121132,8 +123522,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -121179,8 +123569,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -121195,8 +123586,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -121211,7 +123603,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -121228,7 +123621,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -121434,7 +123828,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -121527,7 +123921,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -121720,8 +124114,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -121881,9 +124276,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -121974,8 +124380,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -122017,7 +124423,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -122044,8 +124452,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -122091,8 +124499,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -122107,8 +124516,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -122123,7 +124533,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -122140,7 +124551,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -122346,7 +124758,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -122439,7 +124851,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -122632,8 +125044,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -122793,9 +125206,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -122886,8 +125310,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -122929,7 +125353,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -122956,8 +125382,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -123003,8 +125429,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -123019,8 +125446,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -123035,7 +125463,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -123052,7 +125481,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -123258,7 +125688,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -123351,7 +125781,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -123544,8 +125974,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -123705,9 +126136,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -123798,8 +126240,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -123841,7 +126283,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -123868,8 +126312,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -123915,8 +126359,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -123931,8 +126376,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -123947,7 +126393,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -123964,7 +126411,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -124170,7 +126618,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -124263,7 +126711,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -124456,8 +126904,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -124617,9 +127066,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -124710,8 +127170,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -124753,7 +127213,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -124780,8 +127242,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -124827,8 +127289,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -124843,8 +127306,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -124859,7 +127323,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -124876,7 +127341,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -125082,7 +127548,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -125175,7 +127641,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -125368,8 +127834,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -125529,9 +127996,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -125622,8 +128100,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -125665,7 +128143,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -125692,8 +128172,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -125739,8 +128219,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -125755,8 +128236,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -125771,7 +128253,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -125788,7 +128271,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -125994,7 +128478,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -126087,7 +128571,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -126280,8 +128764,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -126441,9 +128926,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -126534,8 +129030,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -126577,7 +129073,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -126604,8 +129102,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -126651,8 +129149,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -126667,8 +129166,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -126683,7 +129183,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -126700,7 +129201,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -126906,7 +129408,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -126999,7 +129501,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -127192,8 +129694,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -127353,9 +129856,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -127446,8 +129960,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -127489,7 +130003,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -127516,8 +130032,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -127563,8 +130079,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -127579,8 +130096,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -127595,7 +130113,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -127612,7 +130131,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -127818,7 +130338,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -127911,7 +130431,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -128104,8 +130624,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -128265,9 +130786,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -128358,8 +130890,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -128401,7 +130933,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -128428,8 +130962,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -128475,8 +131009,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -128491,8 +131026,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -128507,7 +131043,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -128524,7 +131061,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -128730,7 +131268,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -128823,7 +131361,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -129016,8 +131554,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -129177,9 +131716,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -129270,8 +131820,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -129313,7 +131863,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -129340,8 +131892,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -129387,8 +131939,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -129403,8 +131956,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -129419,7 +131973,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -129436,7 +131991,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -129642,7 +132198,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -129735,7 +132291,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -129928,8 +132484,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -130089,9 +132646,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -130182,8 +132750,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -130225,7 +132793,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -130252,8 +132822,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -130299,8 +132869,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -130315,8 +132886,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -130331,7 +132903,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -130348,7 +132921,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -130554,7 +133128,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -130647,7 +133221,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -130840,8 +133414,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -131001,9 +133576,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -131094,8 +133680,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -131137,7 +133723,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -131164,8 +133752,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -131211,8 +133799,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -131227,8 +133816,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -131243,7 +133833,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -131260,7 +133851,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -131466,7 +134058,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -131559,7 +134151,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -131752,8 +134344,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -131913,9 +134506,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -132006,8 +134610,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -132049,7 +134653,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -132076,8 +134682,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -132123,8 +134729,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -132139,8 +134746,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -132155,7 +134763,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -132172,7 +134781,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -132378,7 +134988,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -132471,7 +135081,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -132664,8 +135274,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -132825,9 +135436,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -132918,8 +135540,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -132961,7 +135583,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -132988,8 +135612,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -133035,8 +135659,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -133051,8 +135676,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -133067,7 +135693,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -133084,7 +135711,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -133290,7 +135918,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -133383,7 +136011,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -133576,8 +136204,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -133737,9 +136366,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -133830,8 +136470,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -133873,7 +136513,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -133900,8 +136542,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -133947,8 +136589,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -133963,8 +136606,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -133979,7 +136623,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -133996,7 +136641,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -134202,7 +136848,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -134295,7 +136941,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -134488,8 +137134,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -134649,9 +137296,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -134742,8 +137400,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -134785,7 +137443,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -134812,8 +137472,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -134859,8 +137519,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -134875,8 +137536,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -134891,7 +137553,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -134908,7 +137571,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -135114,7 +137778,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -135207,7 +137871,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -135400,8 +138064,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -135561,9 +138226,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -135654,8 +138330,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -135697,7 +138373,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -135724,8 +138402,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -135771,8 +138449,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -135787,8 +138466,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -135803,7 +138483,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -135820,7 +138501,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -136026,7 +138708,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -136119,7 +138801,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -136312,8 +138994,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -136473,9 +139156,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -136566,8 +139260,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -136609,7 +139303,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -136636,8 +139332,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -136683,8 +139379,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -136699,8 +139396,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -136715,7 +139413,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -136732,7 +139431,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -136938,7 +139638,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -137031,7 +139731,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -137224,8 +139924,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -137385,9 +140086,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -137478,8 +140190,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -137521,7 +140233,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -137548,8 +140262,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -137595,8 +140309,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -137611,8 +140326,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -137627,7 +140343,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -137644,7 +140361,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -137850,7 +140568,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -137943,7 +140661,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -138136,8 +140854,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -138297,9 +141016,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -138390,8 +141120,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -138433,7 +141163,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -138460,8 +141192,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -138507,8 +141239,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -138523,8 +141256,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -138539,7 +141273,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -138556,7 +141291,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -138762,7 +141498,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -138855,7 +141591,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -139048,8 +141784,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -139209,9 +141946,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -139302,8 +142050,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -139345,7 +142093,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -139372,8 +142122,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -139419,8 +142169,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -139435,8 +142186,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -139451,7 +142203,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -139468,7 +142221,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -139674,7 +142428,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -139767,7 +142521,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -139960,8 +142714,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -140121,9 +142876,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -140214,8 +142980,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -140257,7 +143023,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -140284,8 +143052,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -140331,8 +143099,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -140347,8 +143116,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -140363,7 +143133,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -140380,7 +143151,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -140586,7 +143358,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -140679,7 +143451,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -140872,8 +143644,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -141033,9 +143806,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -141126,8 +143910,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -141169,7 +143953,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -141196,8 +143982,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -141243,8 +144029,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -141259,8 +144046,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -141275,7 +144063,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -141292,7 +144081,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -141498,7 +144288,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -141591,7 +144381,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -141784,8 +144574,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -141945,9 +144736,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -142038,8 +144840,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -142081,7 +144883,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -142108,8 +144912,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -142155,8 +144959,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -142171,8 +144976,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -142187,7 +144993,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -142204,7 +145011,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -142410,7 +145218,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -142503,7 +145311,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -142696,8 +145504,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -142857,9 +145666,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -142950,8 +145770,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -142993,7 +145813,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -143020,8 +145842,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -143067,8 +145889,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -143083,8 +145906,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -143099,7 +145923,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -143116,7 +145941,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -143322,7 +146148,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -143415,7 +146241,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -143608,8 +146434,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -143769,9 +146596,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -143862,8 +146700,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -143905,7 +146743,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -143932,8 +146772,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -143979,8 +146819,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -143995,8 +146836,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -144011,7 +146853,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -144028,7 +146871,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -144234,7 +147078,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -144327,7 +147171,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -144520,8 +147364,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -144681,9 +147526,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -144774,8 +147630,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -144817,7 +147673,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -144844,8 +147702,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -144891,8 +147749,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -144907,8 +147766,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -144923,7 +147783,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -144940,7 +147801,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -145146,7 +148008,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -145239,7 +148101,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -145432,8 +148294,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -145593,9 +148456,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -145686,8 +148560,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -145729,7 +148603,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -145756,8 +148632,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -145803,8 +148679,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -145819,8 +148696,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -145835,7 +148713,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -145852,7 +148731,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -146058,7 +148938,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -146151,7 +149031,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -146344,8 +149224,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -146505,9 +149386,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -146598,8 +149490,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -146641,7 +149533,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -146668,8 +149562,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -146715,8 +149609,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -146731,8 +149626,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -146747,7 +149643,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -146764,7 +149661,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -146970,7 +149868,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -147063,7 +149961,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -147256,8 +150154,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -147417,9 +150316,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -147510,8 +150420,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -147553,7 +150463,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -147580,8 +150492,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -147627,8 +150539,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -147643,8 +150556,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -147659,7 +150573,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -147676,7 +150591,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -147882,7 +150798,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -147975,7 +150891,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -148168,8 +151084,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -148329,9 +151246,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -148422,8 +151350,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -148465,7 +151393,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -148492,8 +151422,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -148539,8 +151469,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -148555,8 +151486,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -148571,7 +151503,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -148588,7 +151521,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -148794,7 +151728,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -148887,7 +151821,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -149080,8 +152014,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -149241,9 +152176,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -149334,8 +152280,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -149377,7 +152323,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -149404,8 +152352,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -149451,8 +152399,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -149467,8 +152416,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -149483,7 +152433,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -149500,7 +152451,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -149706,7 +152658,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -149799,7 +152751,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -149992,8 +152944,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -150153,9 +153106,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -150246,8 +153210,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -150289,7 +153253,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -150316,8 +153282,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -150363,8 +153329,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -150379,8 +153346,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -150395,7 +153363,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -150412,7 +153381,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -150618,7 +153588,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -150711,7 +153681,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -150904,8 +153874,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -151065,9 +154036,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -151158,8 +154140,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -151201,7 +154183,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -151228,8 +154212,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -151275,8 +154259,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -151291,8 +154276,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -151307,7 +154293,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -151324,7 +154311,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -151530,7 +154518,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -151623,7 +154611,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -151816,8 +154804,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -151977,9 +154966,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -152070,8 +155070,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -152113,7 +155113,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -152140,8 +155142,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -152187,8 +155189,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -152203,8 +155206,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -152219,7 +155223,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -152236,7 +155241,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -152442,7 +155448,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -152535,7 +155541,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -152728,8 +155734,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -152889,9 +155896,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -152982,8 +156000,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -153025,7 +156043,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -153052,8 +156072,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -153099,8 +156119,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -153115,8 +156136,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -153131,7 +156153,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -153148,7 +156171,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -153354,7 +156378,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -153447,7 +156471,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -153640,8 +156664,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -153801,9 +156826,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -153894,8 +156930,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -153937,7 +156973,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -153964,8 +157002,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -154011,8 +157049,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -154027,8 +157066,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -154043,7 +157083,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -154060,7 +157101,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -154266,7 +157308,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -154359,7 +157401,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -154552,8 +157594,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -154713,9 +157756,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -154806,8 +157860,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -154849,7 +157903,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -154876,8 +157932,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -154923,8 +157979,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -154939,8 +157996,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -154955,7 +158013,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -154972,7 +158031,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -155178,7 +158238,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -155271,7 +158331,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -155464,8 +158524,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -155625,9 +158686,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -155718,8 +158790,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -155761,7 +158833,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -155788,8 +158862,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -155835,8 +158909,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -155851,8 +158926,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -155867,7 +158943,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -155884,7 +158961,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -156090,7 +159168,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -156183,7 +159261,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -156376,8 +159454,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -156537,9 +159616,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -156630,8 +159720,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -156673,7 +159763,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -156700,8 +159792,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -156747,8 +159839,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -156763,8 +159856,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -156779,7 +159873,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -156796,7 +159891,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -157002,7 +160098,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -157095,7 +160191,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -157288,8 +160384,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -157449,9 +160546,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -157542,8 +160650,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -157585,7 +160693,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -157612,8 +160722,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -157659,8 +160769,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -157675,8 +160786,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -157691,7 +160803,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -157708,7 +160821,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -157914,7 +161028,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -158007,7 +161121,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -158200,8 +161314,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -158361,9 +161476,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -158454,8 +161580,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -158497,7 +161623,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -158524,8 +161652,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -158571,8 +161699,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -158587,8 +161716,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -158603,7 +161733,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -158620,7 +161751,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -158826,7 +161958,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -158919,7 +162051,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -159112,8 +162244,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -159273,9 +162406,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -159366,8 +162510,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -159409,7 +162553,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -159436,8 +162582,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -159483,8 +162629,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -159499,8 +162646,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -159515,7 +162663,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -159532,7 +162681,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -159738,7 +162888,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -159831,7 +162981,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -160024,8 +163174,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -160185,9 +163336,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -160278,8 +163440,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -160321,7 +163483,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -160348,8 +163512,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -160395,8 +163559,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -160411,8 +163576,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -160427,7 +163593,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -160444,7 +163611,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -160650,7 +163818,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -160743,7 +163911,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -160936,8 +164104,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -161097,9 +164266,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -161190,8 +164370,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -161233,7 +164413,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -161260,8 +164442,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -161307,8 +164489,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -161323,8 +164506,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -161339,7 +164523,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -161356,7 +164541,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -161562,7 +164748,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -161655,7 +164841,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -161848,8 +165034,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -162009,9 +165196,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -162102,8 +165300,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -162145,7 +165343,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -162172,8 +165372,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -162219,8 +165419,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -162235,8 +165436,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -162251,7 +165453,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -162268,7 +165471,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -162474,7 +165678,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -162567,7 +165771,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -162760,8 +165964,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -162921,9 +166126,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -163014,8 +166230,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -163057,7 +166273,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -163084,8 +166302,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -163131,8 +166349,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -163147,8 +166366,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -163163,7 +166383,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -163180,7 +166401,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -163386,7 +166608,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -163479,7 +166701,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -163672,8 +166894,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -163833,9 +167056,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -163926,8 +167160,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -163969,7 +167203,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -163996,8 +167232,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -164043,8 +167279,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -164059,8 +167296,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -164075,7 +167313,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -164092,7 +167331,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -164298,7 +167538,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -164391,7 +167631,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -164584,8 +167824,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -164745,9 +167986,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -164838,8 +168090,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -164881,7 +168133,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -164908,8 +168162,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -164955,8 +168209,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -164971,8 +168226,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -164987,7 +168243,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -165004,7 +168261,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -165210,7 +168468,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -165303,7 +168561,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -165496,8 +168754,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -165657,9 +168916,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -165750,8 +169020,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -165793,7 +169063,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -165820,8 +169092,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -165867,8 +169139,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -165883,8 +169156,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -165899,7 +169173,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -165916,7 +169191,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -166122,7 +169398,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -166215,7 +169491,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -166408,8 +169684,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -166569,9 +169846,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -166662,8 +169950,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -166705,7 +169993,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -166732,8 +170022,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -166779,8 +170069,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -166795,8 +170086,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -166811,7 +170103,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -166828,7 +170121,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -167034,7 +170328,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -167127,7 +170421,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -167320,8 +170614,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -167481,9 +170776,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -167574,8 +170880,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -167617,7 +170923,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -167644,8 +170952,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -167691,8 +170999,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -167707,8 +171016,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -167723,7 +171033,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -167740,7 +171051,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -167946,7 +171258,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -168039,7 +171351,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -168232,8 +171544,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -168393,9 +171706,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -168486,8 +171810,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -168529,7 +171853,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -168556,8 +171882,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -168603,8 +171929,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -168619,8 +171946,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -168635,7 +171963,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -168652,7 +171981,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -168858,7 +172188,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -168951,7 +172281,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -169144,8 +172474,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -169305,9 +172636,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -169398,8 +172740,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -169441,7 +172783,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -169468,8 +172812,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -169515,8 +172859,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -169531,8 +172876,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -169547,7 +172893,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -169564,7 +172911,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -169770,7 +173118,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -169863,7 +173211,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -170056,8 +173404,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -170217,9 +173566,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -170310,8 +173670,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -170353,7 +173713,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -170380,8 +173742,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -170427,8 +173789,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -170443,8 +173806,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -170459,7 +173823,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -170476,7 +173841,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -170682,7 +174048,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -170775,7 +174141,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -170968,8 +174334,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -171129,9 +174496,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -171222,8 +174600,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -171265,7 +174643,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -171292,8 +174672,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -171339,8 +174719,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -171355,8 +174736,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -171371,7 +174753,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -171388,7 +174771,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -171594,7 +174978,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -171687,7 +175071,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -171880,8 +175264,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -172041,9 +175426,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -172134,8 +175530,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -172177,7 +175573,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -172204,8 +175602,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -172251,8 +175649,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -172267,8 +175666,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -172283,7 +175683,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -172300,7 +175701,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -172506,7 +175908,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -172599,7 +176001,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -172792,8 +176194,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -172953,9 +176356,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -173046,8 +176460,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -173089,7 +176503,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -173116,8 +176532,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -173163,8 +176579,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -173179,8 +176596,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -173195,7 +176613,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -173212,7 +176631,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -173418,7 +176838,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -173511,7 +176931,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -173704,8 +177124,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -173865,9 +177286,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -173958,8 +177390,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -174001,7 +177433,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -174028,8 +177462,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -174075,8 +177509,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -174091,8 +177526,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -174107,7 +177543,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -174124,7 +177561,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -174330,7 +177768,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -174423,7 +177861,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -174616,8 +178054,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -174777,9 +178216,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -174870,8 +178320,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -174913,7 +178363,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -174940,8 +178392,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -174987,8 +178439,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -175003,8 +178456,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -175019,7 +178473,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -175036,7 +178491,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -175242,7 +178698,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -175335,7 +178791,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -175528,8 +178984,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -175689,9 +179146,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -175782,8 +179250,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -175825,7 +179293,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -175852,8 +179322,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -175899,8 +179369,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -175915,8 +179386,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -175931,7 +179403,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -175948,7 +179421,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -176154,7 +179628,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -176247,7 +179721,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -176440,8 +179914,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -176601,9 +180076,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -176694,8 +180180,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -176737,7 +180223,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -176764,8 +180252,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -176811,8 +180299,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -176827,8 +180316,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -176843,7 +180333,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -176860,7 +180351,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -177066,7 +180558,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -177159,7 +180651,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -177352,8 +180844,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -177513,9 +181006,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -177606,8 +181110,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -177649,7 +181153,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -177676,8 +181182,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -177723,8 +181229,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -177739,8 +181246,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -177755,7 +181263,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -177772,7 +181281,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -177978,7 +181488,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -178071,7 +181581,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -178264,8 +181774,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -178425,9 +181936,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -178518,8 +182040,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -178561,7 +182083,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -178588,8 +182112,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -178635,8 +182159,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -178651,8 +182176,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -178667,7 +182193,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -178684,7 +182211,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -178890,7 +182418,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -178983,7 +182511,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -179176,8 +182704,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -179337,9 +182866,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -179430,8 +182970,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -179473,7 +183013,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -179500,8 +183042,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -179547,8 +183089,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -179563,8 +183106,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -179579,7 +183123,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -179596,7 +183141,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -179802,7 +183348,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -179895,7 +183441,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -180088,8 +183634,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -180249,9 +183796,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -180342,8 +183900,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -180385,7 +183943,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -180412,8 +183972,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -180459,8 +184019,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -180475,8 +184036,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -180491,7 +184053,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -180508,7 +184071,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -180714,7 +184278,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -180807,7 +184371,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -181000,8 +184564,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -181161,9 +184726,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -181254,8 +184830,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -181297,7 +184873,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -181324,8 +184902,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -181371,8 +184949,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -181387,8 +184966,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -181403,7 +184983,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -181420,7 +185001,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -181626,7 +185208,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -181719,7 +185301,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -181912,8 +185494,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -182073,9 +185656,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -182166,8 +185760,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -182209,7 +185803,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -182236,8 +185832,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -182283,8 +185879,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -182299,8 +185896,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -182315,7 +185913,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -182332,7 +185931,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -182538,7 +186138,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -182631,7 +186231,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -182824,8 +186424,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -182985,9 +186586,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -183078,8 +186690,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -183121,7 +186733,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -183148,8 +186762,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -183195,8 +186809,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -183211,8 +186826,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -183227,7 +186843,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -183244,7 +186861,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -183450,7 +187068,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -183543,7 +187161,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -183736,8 +187354,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -183897,9 +187516,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -183990,8 +187620,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -184033,7 +187663,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -184060,8 +187692,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -184107,8 +187739,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -184123,8 +187756,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -184139,7 +187773,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -184156,7 +187791,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -184362,7 +187998,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -184455,7 +188091,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -184648,8 +188284,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -184809,9 +188446,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -184902,8 +188550,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -184945,7 +188593,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -184972,8 +188622,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -185019,8 +188669,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -185035,8 +188686,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -185051,7 +188703,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -185068,7 +188721,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -185274,7 +188928,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -185367,7 +189021,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -185560,8 +189214,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -185721,9 +189376,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -185814,8 +189480,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -185857,7 +189523,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -185884,8 +189552,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -185931,8 +189599,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -185947,8 +189616,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -185963,7 +189633,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -185980,7 +189651,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -186186,7 +189858,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -186279,7 +189951,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -186472,8 +190144,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -186633,9 +190306,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -186726,8 +190410,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -186769,7 +190453,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -186796,8 +190482,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -186843,8 +190529,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -186859,8 +190546,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -186875,7 +190563,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -186892,7 +190581,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -187098,7 +190788,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -187191,7 +190881,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -187384,8 +191074,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -187545,9 +191236,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -187638,8 +191340,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -187681,7 +191383,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -187708,8 +191412,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -187755,8 +191459,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -187771,8 +191476,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -187787,7 +191493,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -187804,7 +191511,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -188010,7 +191718,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -188103,7 +191811,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -188296,8 +192004,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -188457,9 +192166,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -188550,8 +192270,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -188593,7 +192313,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -188620,8 +192342,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -188667,8 +192389,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -188683,8 +192406,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -188699,7 +192423,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -188716,7 +192441,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -188922,7 +192648,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -189015,7 +192741,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -189208,8 +192934,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -189369,9 +193096,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -189462,8 +193200,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -189505,7 +193243,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -189532,8 +193272,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -189579,8 +193319,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -189595,8 +193336,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -189611,7 +193353,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -189628,7 +193371,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -189834,7 +193578,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -189927,7 +193671,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -190120,8 +193864,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -190281,9 +194026,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -190374,8 +194130,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -190417,7 +194173,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -190444,8 +194202,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -190491,8 +194249,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -190507,8 +194266,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -190523,7 +194283,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -190540,7 +194301,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -190746,7 +194508,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -190839,7 +194601,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -191032,8 +194794,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -191193,9 +194956,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -191286,8 +195060,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -191329,7 +195103,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -191356,8 +195132,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -191403,8 +195179,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -191419,8 +195196,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -191435,7 +195213,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -191452,7 +195231,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -191658,7 +195438,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -191751,7 +195531,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -191944,8 +195724,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -192105,9 +195886,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -192198,8 +195990,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -192241,7 +196033,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -192268,8 +196062,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -192315,8 +196109,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -192331,8 +196126,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -192347,7 +196143,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -192364,7 +196161,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -192570,7 +196368,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -192663,7 +196461,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -192856,8 +196654,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -193017,9 +196816,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -193110,8 +196920,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -193153,7 +196963,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -193180,8 +196992,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -193227,8 +197039,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -193243,8 +197056,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -193259,7 +197073,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -193276,7 +197091,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -193482,7 +197298,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -193575,7 +197391,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -193768,8 +197584,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -193929,9 +197746,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -194022,8 +197850,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -194065,7 +197893,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -194092,8 +197922,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -194139,8 +197969,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -194155,8 +197986,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -194171,7 +198003,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -194188,7 +198021,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -194394,7 +198228,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -194487,7 +198321,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -194680,8 +198514,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -194841,9 +198676,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -194934,8 +198780,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -194977,7 +198823,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -195004,8 +198852,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -195051,8 +198899,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -195067,8 +198916,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -195083,7 +198933,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -195100,7 +198951,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -195306,7 +199158,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -195399,7 +199251,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -195592,8 +199444,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -195753,9 +199606,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -195846,8 +199710,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -195889,7 +199753,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -195916,8 +199782,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -195963,8 +199829,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -195979,8 +199846,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -195995,7 +199863,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -196012,7 +199881,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -196218,7 +200088,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -196311,7 +200181,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -196504,8 +200374,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -196665,9 +200536,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -196758,8 +200640,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -196801,7 +200683,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -196828,8 +200712,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -196875,8 +200759,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -196891,8 +200776,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -196907,7 +200793,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -196924,7 +200811,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -197130,7 +201018,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -197223,7 +201111,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -197416,8 +201304,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -197577,9 +201466,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -197670,8 +201570,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -197713,7 +201613,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -197740,8 +201642,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -197787,8 +201689,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -197803,8 +201706,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -197819,7 +201723,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -197836,7 +201741,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -198042,7 +201948,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -198135,7 +202041,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -198328,8 +202234,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -198489,9 +202396,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -198582,8 +202500,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -198625,7 +202543,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -198652,8 +202572,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -198699,8 +202619,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -198715,8 +202636,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -198731,7 +202653,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -198748,7 +202671,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -198954,7 +202878,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -199047,7 +202971,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -199240,8 +203164,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -199401,9 +203326,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -199494,8 +203430,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -199537,7 +203473,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -199564,8 +203502,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -199611,8 +203549,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -199627,8 +203566,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -199643,7 +203583,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -199660,7 +203601,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -199866,7 +203808,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -199959,7 +203901,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -200152,8 +204094,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -200313,9 +204256,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -200406,8 +204360,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -200449,7 +204403,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -200476,8 +204432,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -200523,8 +204479,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -200539,8 +204496,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -200555,7 +204513,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -200572,7 +204531,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -200778,7 +204738,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -200871,7 +204831,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -201064,8 +205024,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -201225,9 +205186,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -201318,8 +205290,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -201361,7 +205333,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -201388,8 +205362,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -201435,8 +205409,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -201451,8 +205426,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -201467,7 +205443,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -201484,7 +205461,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -201690,7 +205668,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -201783,7 +205761,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -201976,8 +205954,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -202137,9 +206116,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -202230,8 +206220,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -202273,7 +206263,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -202300,8 +206292,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -202347,8 +206339,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -202363,8 +206356,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -202379,7 +206373,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -202396,7 +206391,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -202602,7 +206598,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -202695,7 +206691,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -202888,8 +206884,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -203049,9 +207046,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -203142,8 +207150,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -203185,7 +207193,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -203212,8 +207222,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -203259,8 +207269,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -203275,8 +207286,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -203291,7 +207303,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -203308,7 +207321,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -203514,7 +207528,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -203607,7 +207621,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -203800,8 +207814,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -203961,9 +207976,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -204054,8 +208080,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -204097,7 +208123,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -204124,8 +208152,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -204171,8 +208199,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -204187,8 +208216,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -204203,7 +208233,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -204220,7 +208251,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -204426,7 +208458,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -204519,7 +208551,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -204712,8 +208744,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -204873,9 +208906,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -204966,8 +209010,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -205009,7 +209053,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -205036,8 +209082,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -205083,8 +209129,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -205099,8 +209146,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -205115,7 +209163,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -205132,7 +209181,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -205338,7 +209388,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -205431,7 +209481,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -205624,8 +209674,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -205785,9 +209836,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -205878,8 +209940,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -205921,7 +209983,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -205948,8 +210012,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -205995,8 +210059,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -206011,8 +210076,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -206027,7 +210093,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -206044,7 +210111,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -206250,7 +210318,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -206343,7 +210411,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -206536,8 +210604,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -206697,9 +210766,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -206790,8 +210870,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -206833,7 +210913,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -206860,8 +210942,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -206907,8 +210989,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -206923,8 +211006,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -206939,7 +211023,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -206956,7 +211041,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -207162,7 +211248,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -207255,7 +211341,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -207448,8 +211534,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -207609,9 +211696,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -207702,8 +211800,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -207745,7 +211843,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -207772,8 +211872,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -207819,8 +211919,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -207835,8 +211936,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -207851,7 +211953,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -207868,7 +211971,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -208074,7 +212178,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -208167,7 +212271,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -208360,8 +212464,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -208521,9 +212626,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -208614,8 +212730,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -208657,7 +212773,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -208684,8 +212802,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -208731,8 +212849,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -208747,8 +212866,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -208763,7 +212883,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -208780,7 +212901,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -208986,7 +213108,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -209079,7 +213201,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -209272,8 +213394,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -209433,9 +213556,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -209526,8 +213660,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -209569,7 +213703,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -209596,8 +213732,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -209643,8 +213779,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -209659,8 +213796,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -209675,7 +213813,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -209692,7 +213831,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -209898,7 +214038,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -209991,7 +214131,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -210184,8 +214324,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -210345,9 +214486,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -210438,8 +214590,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -210481,7 +214633,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -210508,8 +214662,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -210555,8 +214709,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -210571,8 +214726,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -210587,7 +214743,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -210604,7 +214761,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -210810,7 +214968,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -210903,7 +215061,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -211096,8 +215254,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -211257,9 +215416,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -211350,8 +215520,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -211393,7 +215563,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -211420,8 +215592,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -211467,8 +215639,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -211483,8 +215656,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -211499,7 +215673,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -211516,7 +215691,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -211722,7 +215898,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -211815,7 +215991,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -212008,8 +216184,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -212169,9 +216346,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -212262,8 +216450,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -212305,7 +216493,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -212332,8 +216522,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -212379,8 +216569,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -212395,8 +216586,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -212411,7 +216603,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -212428,7 +216621,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -212634,7 +216828,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -212727,7 +216921,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -212920,8 +217114,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -213081,9 +217276,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -213174,8 +217380,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -213217,7 +217423,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -213244,8 +217452,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -213291,8 +217499,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -213307,8 +217516,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -213323,7 +217533,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -213340,7 +217551,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -213546,7 +217758,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -213639,7 +217851,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -213832,8 +218044,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -213993,9 +218206,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -214086,8 +218310,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -214129,7 +218353,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -214156,8 +218382,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -214203,8 +218429,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -214219,8 +218446,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -214235,7 +218463,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -214252,7 +218481,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -214458,7 +218688,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -214551,7 +218781,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -214744,8 +218974,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -214905,9 +219136,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -214998,8 +219240,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -215041,7 +219283,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -215068,8 +219312,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -215115,8 +219359,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -215131,8 +219376,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -215147,7 +219393,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -215164,7 +219411,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -215370,7 +219618,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -215463,7 +219711,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -215656,8 +219904,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -215817,9 +220066,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -215910,8 +220170,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -215953,7 +220213,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -215980,8 +220242,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -216027,8 +220289,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -216043,8 +220306,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -216059,7 +220323,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -216076,7 +220341,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -216282,7 +220548,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -216375,7 +220641,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -216568,8 +220834,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -216729,9 +220996,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -216822,8 +221100,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -216865,7 +221143,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -216892,8 +221172,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -216939,8 +221219,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -216955,8 +221236,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -216971,7 +221253,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -216988,7 +221271,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -217194,7 +221478,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -217287,7 +221571,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -217480,8 +221764,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -217641,9 +221926,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -217734,8 +222030,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -217777,7 +222073,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -217804,8 +222102,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -217851,8 +222149,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -217867,8 +222166,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -217883,7 +222183,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -217900,7 +222201,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -218106,7 +222408,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -218199,7 +222501,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -218392,8 +222694,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -218553,9 +222856,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -218646,8 +222960,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -218689,7 +223003,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -218716,8 +223032,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -218763,8 +223079,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -218779,8 +223096,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -218795,7 +223113,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -218812,7 +223131,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -219018,7 +223338,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -219111,7 +223431,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -219304,8 +223624,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -219465,9 +223786,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -219558,8 +223890,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -219601,7 +223933,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -219628,8 +223962,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -219675,8 +224009,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -219691,8 +224026,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -219707,7 +224043,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -219724,7 +224061,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -219930,7 +224268,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -220023,7 +224361,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -220216,8 +224554,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -220377,9 +224716,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -220470,8 +224820,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -220513,7 +224863,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -220540,8 +224892,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -220587,8 +224939,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -220603,8 +224956,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -220619,7 +224973,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -220636,7 +224991,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -220842,7 +225198,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -220935,7 +225291,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -221128,8 +225484,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -221289,9 +225646,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -221382,8 +225750,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -221425,7 +225793,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -221452,8 +225822,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -221499,8 +225869,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -221515,8 +225886,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -221531,7 +225903,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -221548,7 +225921,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -221754,7 +226128,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -221847,7 +226221,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -222040,8 +226414,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -222201,9 +226576,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -222294,8 +226680,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -222337,7 +226723,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -222364,8 +226752,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -222411,8 +226799,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -222427,8 +226816,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -222443,7 +226833,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -222460,7 +226851,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -222666,7 +227058,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -222759,7 +227151,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -222952,8 +227344,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -223113,9 +227506,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -223206,8 +227610,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -223249,7 +227653,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -223276,8 +227682,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -223323,8 +227729,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -223339,8 +227746,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -223355,7 +227763,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -223372,7 +227781,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -223578,7 +227988,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -223671,7 +228081,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -223864,8 +228274,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -224025,9 +228436,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -224118,8 +228540,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -224161,7 +228583,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -224188,8 +228612,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -224235,8 +228659,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -224251,8 +228676,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -224267,7 +228693,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -224284,7 +228711,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -224490,7 +228918,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -224583,7 +229011,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -224776,8 +229204,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -224937,9 +229366,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -225030,8 +229470,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -225073,7 +229513,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -225100,8 +229542,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -225147,8 +229589,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -225163,8 +229606,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -225179,7 +229623,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -225196,7 +229641,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -225402,7 +229848,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -225495,7 +229941,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -225688,8 +230134,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -225849,9 +230296,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -225942,8 +230400,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -225985,7 +230443,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -226012,8 +230472,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -226059,8 +230519,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -226075,8 +230536,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -226091,7 +230553,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -226108,7 +230571,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -226314,7 +230778,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -226407,7 +230871,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -226600,8 +231064,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -226761,9 +231226,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -226854,8 +231330,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -226897,7 +231373,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -226924,8 +231402,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -226971,8 +231449,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -226987,8 +231466,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -227003,7 +231483,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -227020,7 +231501,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -227226,7 +231708,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -227319,7 +231801,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -227512,8 +231994,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -227673,9 +232156,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -227766,8 +232260,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -227809,7 +232303,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -227836,8 +232332,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -227883,8 +232379,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -227899,8 +232396,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -227915,7 +232413,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -227932,7 +232431,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -228138,7 +232638,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -228231,7 +232731,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -228424,8 +232924,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -228585,9 +233086,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -228678,8 +233190,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -228721,7 +233233,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -228748,8 +233262,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -228795,8 +233309,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -228811,8 +233326,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -228827,7 +233343,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -228844,7 +233361,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -229050,7 +233568,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -229143,7 +233661,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -229336,8 +233854,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -229497,9 +234016,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -229590,8 +234120,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -229633,7 +234163,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -229660,8 +234192,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -229707,8 +234239,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -229723,8 +234256,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -229739,7 +234273,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -229756,7 +234291,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -229962,7 +234498,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -230055,7 +234591,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -230248,8 +234784,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -230409,9 +234946,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -230502,8 +235050,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -230545,7 +235093,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -230572,8 +235122,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -230619,8 +235169,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -230635,8 +235186,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -230651,7 +235203,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -230668,7 +235221,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -230874,7 +235428,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -230967,7 +235521,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -231160,8 +235714,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -231321,9 +235876,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -231414,8 +235980,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -231457,7 +236023,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -231484,8 +236052,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -231531,8 +236099,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -231547,8 +236116,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -231563,7 +236133,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -231580,7 +236151,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -231786,7 +236358,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -231879,7 +236451,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -232072,8 +236644,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -232233,9 +236806,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -232326,8 +236910,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -232369,7 +236953,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -232396,8 +236982,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -232443,8 +237029,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -232459,8 +237046,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -232475,7 +237063,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -232492,7 +237081,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -232698,7 +237288,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -232791,7 +237381,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -232984,8 +237574,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -233145,9 +237736,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -233238,8 +237840,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -233281,7 +237883,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -233308,8 +237912,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -233355,8 +237959,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -233371,8 +237976,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -233387,7 +237993,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -233404,7 +238011,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -233610,7 +238218,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -233703,7 +238311,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -233896,8 +238504,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -234057,9 +238666,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -234150,8 +238770,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -234193,7 +238813,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -234220,8 +238842,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -234267,8 +238889,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -234283,8 +238906,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -234299,7 +238923,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -234316,7 +238941,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -234522,7 +239148,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -234615,7 +239241,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -234808,8 +239434,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -234969,9 +239596,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -235062,8 +239700,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -235105,7 +239743,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -235132,8 +239772,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -235179,8 +239819,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -235195,8 +239836,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -235211,7 +239853,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -235228,7 +239871,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -235434,7 +240078,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -235527,7 +240171,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -235720,8 +240364,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -235881,9 +240526,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -235974,8 +240630,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -236017,7 +240673,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -236044,8 +240702,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -236091,8 +240749,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -236107,8 +240766,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -236123,7 +240783,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -236140,7 +240801,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -236346,7 +241008,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -236439,7 +241101,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -236632,8 +241294,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -236793,9 +241456,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -236886,8 +241560,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -236929,7 +241603,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -236956,8 +241632,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -237003,8 +241679,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -237019,8 +241696,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -237035,7 +241713,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -237052,7 +241731,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -237258,7 +241938,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -237351,7 +242031,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -237544,8 +242224,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -237705,9 +242386,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -237798,8 +242490,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -237841,7 +242533,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -237868,8 +242562,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -237915,8 +242609,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -237931,8 +242626,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -237947,7 +242643,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -237964,7 +242661,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -238170,7 +242868,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -238263,7 +242961,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -238456,8 +243154,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -238617,9 +243316,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -238710,8 +243420,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -238753,7 +243463,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -238780,8 +243492,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -238827,8 +243539,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -238843,8 +243556,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -238859,7 +243573,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -238876,7 +243591,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -239082,7 +243798,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -239175,7 +243891,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -239368,8 +244084,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -239529,9 +244246,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -239622,8 +244350,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -239665,7 +244393,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -239692,8 +244422,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -239739,8 +244469,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -239755,8 +244486,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -239771,7 +244503,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -239788,7 +244521,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -239994,7 +244728,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -240087,7 +244821,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -240280,8 +245014,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -240441,9 +245176,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -240534,8 +245280,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -240577,7 +245323,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -240604,8 +245352,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -240651,8 +245399,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -240667,8 +245416,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -240683,7 +245433,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -240700,7 +245451,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -240906,7 +245658,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -240999,7 +245751,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -241192,8 +245944,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -241353,9 +246106,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -241446,8 +246210,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -241489,7 +246253,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -241516,8 +246282,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -241563,8 +246329,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -241579,8 +246346,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -241595,7 +246363,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -241612,7 +246381,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -241818,7 +246588,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -241911,7 +246681,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -242104,8 +246874,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -242265,9 +247036,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -242358,8 +247140,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -242401,7 +247183,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -242428,8 +247212,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -242475,8 +247259,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -242491,8 +247276,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -242507,7 +247293,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -242524,7 +247311,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -242730,7 +247518,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -242823,7 +247611,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -243016,8 +247804,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -243177,9 +247966,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -243270,8 +248070,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -243313,7 +248113,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -243340,8 +248142,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -243387,8 +248189,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -243403,8 +248206,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -243419,7 +248223,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -243436,7 +248241,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -243642,7 +248448,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -243735,7 +248541,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -243928,8 +248734,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -244089,9 +248896,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -244182,8 +249000,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -244225,7 +249043,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -244252,8 +249072,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -244299,8 +249119,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -244315,8 +249136,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -244331,7 +249153,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -244348,7 +249171,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -244554,7 +249378,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -244647,7 +249471,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -244840,8 +249664,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -245001,9 +249826,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -245094,8 +249930,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -245137,7 +249973,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -245164,8 +250002,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -245211,8 +250049,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -245227,8 +250066,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -245243,7 +250083,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -245260,7 +250101,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -245466,7 +250308,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -245559,7 +250401,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -245752,8 +250594,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -245913,9 +250756,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -246006,8 +250860,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -246049,7 +250903,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -246076,8 +250932,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -246123,8 +250979,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -246139,8 +250996,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -246155,7 +251013,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -246172,7 +251031,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -246378,7 +251238,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -246471,7 +251331,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -246664,8 +251524,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -246825,9 +251686,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -246918,8 +251790,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -246961,7 +251833,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -246988,8 +251862,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -247035,8 +251909,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -247051,8 +251926,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -247067,7 +251943,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -247084,7 +251961,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -247290,7 +252168,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -247383,7 +252261,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -247576,8 +252454,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -247737,9 +252616,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -247830,8 +252720,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -247873,7 +252763,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -247900,8 +252792,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -247947,8 +252839,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -247963,8 +252856,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -247979,7 +252873,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -247996,7 +252891,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -248202,7 +253098,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -248295,7 +253191,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -248488,8 +253384,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -248649,9 +253546,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -248742,8 +253650,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -248785,7 +253693,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -248812,8 +253722,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -248859,8 +253769,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -248875,8 +253786,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -248891,7 +253803,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -248908,7 +253821,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -249114,7 +254028,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -249207,7 +254121,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -249400,8 +254314,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -249561,9 +254476,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -249654,8 +254580,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -249697,7 +254623,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -249724,8 +254652,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -249771,8 +254699,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -249787,8 +254716,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -249803,7 +254733,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -249820,7 +254751,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -250026,7 +254958,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -250119,7 +255051,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -250312,8 +255244,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -250473,9 +255406,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -250566,8 +255510,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -250609,7 +255553,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -250636,8 +255582,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -250683,8 +255629,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -250699,8 +255646,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -250715,7 +255663,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -250732,7 +255681,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -250938,7 +255888,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -251031,7 +255981,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -251224,8 +256174,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -251385,9 +256336,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -251478,8 +256440,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -251521,7 +256483,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -251548,8 +256512,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -251595,8 +256559,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -251611,8 +256576,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -251627,7 +256593,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -251644,7 +256611,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -251850,7 +256818,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -251943,7 +256911,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -252136,8 +257104,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -252297,9 +257266,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -252390,8 +257370,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -252433,7 +257413,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -252460,8 +257442,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -252507,8 +257489,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -252523,8 +257506,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -252539,7 +257523,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -252556,7 +257541,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -252762,7 +257748,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -252855,7 +257841,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -253048,8 +258034,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -253209,9 +258196,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -253302,8 +258300,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -253345,7 +258343,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -253372,8 +258372,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -253419,8 +258419,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -253435,8 +258436,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -253451,7 +258453,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -253468,7 +258471,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -253674,7 +258678,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -253767,7 +258771,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -253960,8 +258964,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -254121,9 +259126,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -254214,8 +259230,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -254257,7 +259273,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -254284,8 +259302,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -254331,8 +259349,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -254347,8 +259366,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -254363,7 +259383,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -254380,7 +259401,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -254586,7 +259608,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -254679,7 +259701,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -254872,8 +259894,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -255033,9 +260056,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -255126,8 +260160,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -255169,7 +260203,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -255196,8 +260232,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -255243,8 +260279,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -255259,8 +260296,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -255275,7 +260313,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -255292,7 +260331,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -255498,7 +260538,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -255591,7 +260631,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -255784,8 +260824,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -255945,9 +260986,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -256038,8 +261090,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -256081,7 +261133,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -256108,8 +261162,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -256155,8 +261209,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -256171,8 +261226,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -256187,7 +261243,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -256204,7 +261261,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -256410,7 +261468,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -256503,7 +261561,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -256696,8 +261754,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -256857,9 +261916,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -256950,8 +262020,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -256993,7 +262063,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -257020,8 +262092,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -257067,8 +262139,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -257083,8 +262156,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -257099,7 +262173,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -257116,7 +262191,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -257322,7 +262398,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -257415,7 +262491,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -257608,8 +262684,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -257769,9 +262846,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -257862,8 +262950,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -257905,7 +262993,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -257932,8 +263022,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -257979,8 +263069,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -257995,8 +263086,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -258011,7 +263103,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -258028,7 +263121,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -258234,7 +263328,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -258327,7 +263421,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -258520,8 +263614,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -258681,9 +263776,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -258774,8 +263880,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -258817,7 +263923,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -258844,8 +263952,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -258891,8 +263999,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -258907,8 +264016,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -258923,7 +264033,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -258940,7 +264051,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -259146,7 +264258,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -259239,7 +264351,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -259432,8 +264544,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -259593,9 +264706,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -259686,8 +264810,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -259729,7 +264853,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -259756,8 +264882,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -259803,8 +264929,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -259819,8 +264946,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -259835,7 +264963,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -259852,7 +264981,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -260058,7 +265188,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -260151,7 +265281,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -260344,8 +265474,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -260505,9 +265636,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -260598,8 +265740,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -260641,7 +265783,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -260668,8 +265812,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -260715,8 +265859,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -260731,8 +265876,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -260747,7 +265893,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -260764,7 +265911,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -260970,7 +266118,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -261063,7 +266211,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -261256,8 +266404,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -261417,9 +266566,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -261510,8 +266670,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -261553,7 +266713,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -261580,8 +266742,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -261627,8 +266789,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -261643,8 +266806,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -261659,7 +266823,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -261676,7 +266841,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -261882,7 +267048,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -261975,7 +267141,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -262168,8 +267334,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -262329,9 +267496,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -262422,8 +267600,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -262465,7 +267643,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -262492,8 +267672,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -262539,8 +267719,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -262555,8 +267736,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -262571,7 +267753,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -262588,7 +267771,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -262794,7 +267978,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -262887,7 +268071,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -263080,8 +268264,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -263241,9 +268426,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -263334,8 +268530,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -263377,7 +268573,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -263404,8 +268602,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -263451,8 +268649,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -263467,8 +268666,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -263483,7 +268683,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -263500,7 +268701,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -263706,7 +268908,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -263799,7 +269001,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -263992,8 +269194,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -264153,9 +269356,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -264246,8 +269460,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -264289,7 +269503,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -264316,8 +269532,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -264363,8 +269579,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -264379,8 +269596,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -264395,7 +269613,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -264412,7 +269631,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -264618,7 +269838,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -264711,7 +269931,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -264904,8 +270124,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -265065,9 +270286,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -265158,8 +270390,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -265201,7 +270433,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -265228,8 +270462,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -265275,8 +270509,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -265291,8 +270526,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -265307,7 +270543,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -265324,7 +270561,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -265530,7 +270768,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -265623,7 +270861,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -265816,8 +271054,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -265977,9 +271216,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -266070,8 +271320,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -266113,7 +271363,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -266140,8 +271392,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -266187,8 +271439,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -266203,8 +271456,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -266219,7 +271473,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -266236,7 +271491,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -266442,7 +271698,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -266535,7 +271791,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -266728,8 +271984,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -266889,9 +272146,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -266982,8 +272250,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -267025,7 +272293,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -267052,8 +272322,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -267099,8 +272369,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -267115,8 +272386,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -267131,7 +272403,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -267148,7 +272421,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -267354,7 +272628,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -267447,7 +272721,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -267640,8 +272914,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -267801,9 +273076,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -267894,8 +273180,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -267937,7 +273223,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -267964,8 +273252,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -268011,8 +273299,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -268027,8 +273316,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -268043,7 +273333,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -268060,7 +273351,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -268266,7 +273558,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -268359,7 +273651,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -268552,8 +273844,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -268713,9 +274006,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -268806,8 +274110,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -268849,7 +274153,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -268876,8 +274182,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -268923,8 +274229,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -268939,8 +274246,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -268955,7 +274263,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -268972,7 +274281,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -269178,7 +274488,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -269271,7 +274581,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -269464,8 +274774,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -269625,9 +274936,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -269718,8 +275040,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -269761,7 +275083,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -269788,8 +275112,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -269835,8 +275159,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -269851,8 +275176,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -269867,7 +275193,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -269884,7 +275211,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -270090,7 +275418,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -270183,7 +275511,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -270376,8 +275704,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -270537,9 +275866,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -270630,8 +275970,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -270673,7 +276013,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -270700,8 +276042,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -270747,8 +276089,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -270763,8 +276106,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -270779,7 +276123,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -270796,7 +276141,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -271002,7 +276348,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -271095,7 +276441,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -271288,8 +276634,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -271449,9 +276796,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -271542,8 +276900,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -271585,7 +276943,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -271612,8 +276972,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -271659,8 +277019,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -271675,8 +277036,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -271691,7 +277053,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -271708,7 +277071,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -271914,7 +277278,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -272007,7 +277371,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -272200,8 +277564,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -272361,9 +277726,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -272454,8 +277830,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -272497,7 +277873,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -272524,8 +277902,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -272571,8 +277949,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -272587,8 +277966,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -272603,7 +277983,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -272620,7 +278001,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -272826,7 +278208,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -272919,7 +278301,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -273112,8 +278494,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -273273,9 +278656,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -273366,8 +278760,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -273409,7 +278803,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -273436,8 +278832,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -273483,8 +278879,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -273499,8 +278896,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -273515,7 +278913,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -273532,7 +278931,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -273738,7 +279138,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -273831,7 +279231,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -274024,8 +279424,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -274185,9 +279586,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -274278,8 +279690,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -274321,7 +279733,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -274348,8 +279762,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -274395,8 +279809,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -274411,8 +279826,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -274427,7 +279843,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -274444,7 +279861,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -274650,7 +280068,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -274743,7 +280161,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -274936,8 +280354,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -275097,9 +280516,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -275190,8 +280620,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -275233,7 +280663,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -275260,8 +280692,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -275307,8 +280739,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -275323,8 +280756,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -275339,7 +280773,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -275356,7 +280791,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -275562,7 +280998,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -275655,7 +281091,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -275848,8 +281284,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -276009,9 +281446,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -276102,8 +281550,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -276145,7 +281593,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -276172,8 +281622,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -276219,8 +281669,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -276235,8 +281686,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -276251,7 +281703,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -276268,7 +281721,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -276474,7 +281928,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -276567,7 +282021,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -276760,8 +282214,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -276921,9 +282376,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -277014,8 +282480,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -277057,7 +282523,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -277084,8 +282552,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -277131,8 +282599,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -277147,8 +282616,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -277163,7 +282633,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -277180,7 +282651,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -277386,7 +282858,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -277479,7 +282951,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -277672,8 +283144,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -277833,9 +283306,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -277926,8 +283410,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -277969,7 +283453,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -277996,8 +283482,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -278043,8 +283529,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -278059,8 +283546,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -278075,7 +283563,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -278092,7 +283581,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -278298,7 +283788,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -278391,7 +283881,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -278584,8 +284074,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -278745,9 +284236,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -278838,8 +284340,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -278881,7 +284383,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -278908,8 +284412,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -278955,8 +284459,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -278971,8 +284476,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -278987,7 +284493,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -279004,7 +284511,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -279210,7 +284718,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -279303,7 +284811,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -279496,8 +285004,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -279657,9 +285166,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -279750,8 +285270,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -279793,7 +285313,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -279820,8 +285342,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -279867,8 +285389,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -279883,8 +285406,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -279899,7 +285423,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -279916,7 +285441,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -280122,7 +285648,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -280215,7 +285741,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -280408,8 +285934,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -280569,9 +286096,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -280662,8 +286200,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -280705,7 +286243,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -280732,8 +286272,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -280779,8 +286319,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -280795,8 +286336,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -280811,7 +286353,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -280828,7 +286371,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -281034,7 +286578,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -281127,7 +286671,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -281320,8 +286864,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -281481,9 +287026,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -281574,8 +287130,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -281617,7 +287173,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -281644,8 +287202,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -281691,8 +287249,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -281707,8 +287266,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -281723,7 +287283,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -281740,7 +287301,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -281946,7 +287508,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -282039,7 +287601,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -282232,8 +287794,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -282393,9 +287956,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -282486,8 +288060,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -282529,7 +288103,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -282556,8 +288132,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -282603,8 +288179,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -282619,8 +288196,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -282635,7 +288213,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -282652,7 +288231,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -282858,7 +288438,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -282951,7 +288531,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -283144,8 +288724,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -283305,9 +288886,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -283398,8 +288990,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -283441,7 +289033,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -283468,8 +289062,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -283515,8 +289109,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -283531,8 +289126,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -283547,7 +289143,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -283564,7 +289161,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -283770,7 +289368,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -283863,7 +289461,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -284056,8 +289654,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -284217,9 +289816,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -284310,8 +289920,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -284353,7 +289963,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -284380,8 +289992,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -284427,8 +290039,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -284443,8 +290056,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -284459,7 +290073,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -284476,7 +290091,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -284682,7 +290298,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -284775,7 +290391,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -284968,8 +290584,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -285129,9 +290746,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -285222,8 +290850,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -285265,7 +290893,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -285292,8 +290922,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -285339,8 +290969,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -285355,8 +290986,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -285371,7 +291003,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -285388,7 +291021,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -285594,7 +291228,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -285687,7 +291321,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -285880,8 +291514,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -286041,9 +291676,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -286134,8 +291780,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -286177,7 +291823,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -286204,8 +291852,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -286251,8 +291899,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -286267,8 +291916,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -286283,7 +291933,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -286300,7 +291951,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -286506,7 +292158,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -286599,7 +292251,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -286792,8 +292444,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -286953,9 +292606,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -287046,8 +292710,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -287089,7 +292753,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -287116,8 +292782,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -287163,8 +292829,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -287179,8 +292846,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -287195,7 +292863,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -287212,7 +292881,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -287418,7 +293088,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -287511,7 +293181,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -287704,8 +293374,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -287865,9 +293536,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -287958,8 +293640,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -288001,7 +293683,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -288028,8 +293712,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -288075,8 +293759,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -288091,8 +293776,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -288107,7 +293793,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -288124,7 +293811,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -288330,7 +294018,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -288423,7 +294111,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -288616,8 +294304,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -288777,9 +294466,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -288870,8 +294570,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -288913,7 +294613,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -288940,8 +294642,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -288987,8 +294689,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -289003,8 +294706,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -289019,7 +294723,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -289036,7 +294741,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -289242,7 +294948,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -289335,7 +295041,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -289528,8 +295234,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -289689,9 +295396,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -289782,8 +295500,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -289825,7 +295543,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -289852,8 +295572,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -289899,8 +295619,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -289915,8 +295636,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -289931,7 +295653,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -289948,7 +295671,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -290154,7 +295878,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -290247,7 +295971,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -290440,8 +296164,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -290601,9 +296326,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -290694,8 +296430,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -290737,7 +296473,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -290764,8 +296502,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -290811,8 +296549,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -290827,8 +296566,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -290843,7 +296583,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -290860,7 +296601,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -291066,7 +296808,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -291159,7 +296901,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -291352,8 +297094,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -291513,9 +297256,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -291606,8 +297360,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -291649,7 +297403,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -291676,8 +297432,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -291723,8 +297479,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -291739,8 +297496,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -291755,7 +297513,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -291772,7 +297531,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -291978,7 +297738,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -292071,7 +297831,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -292264,8 +298024,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -292425,9 +298186,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -292518,8 +298290,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -292561,7 +298333,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -292588,8 +298362,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -292635,8 +298409,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -292651,8 +298426,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -292667,7 +298443,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -292684,7 +298461,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -292890,7 +298668,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -292983,7 +298761,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -293176,8 +298954,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -293337,9 +299116,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -293430,8 +299220,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -293473,7 +299263,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -293500,8 +299292,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -293547,8 +299339,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -293563,8 +299356,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -293579,7 +299373,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -293596,7 +299391,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -293802,7 +299598,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -293895,7 +299691,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -294088,8 +299884,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -294249,9 +300046,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -294342,8 +300150,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -294385,7 +300193,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -294412,8 +300222,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -294459,8 +300269,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -294475,8 +300286,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -294491,7 +300303,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -294508,7 +300321,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -294714,7 +300528,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -294807,7 +300621,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -295000,8 +300814,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -295161,9 +300976,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -295254,8 +301080,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -295297,7 +301123,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -295324,8 +301152,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -295371,8 +301199,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -295387,8 +301216,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -295403,7 +301233,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -295420,7 +301251,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -295626,7 +301458,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -295719,7 +301551,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -295912,8 +301744,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -296073,9 +301906,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -296166,8 +302010,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -296209,7 +302053,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -296236,8 +302082,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -296283,8 +302129,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -296299,8 +302146,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -296315,7 +302163,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -296332,7 +302181,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -296538,7 +302388,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -296631,7 +302481,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -296824,8 +302674,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -296985,9 +302836,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -297078,8 +302940,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -297121,7 +302983,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -297148,8 +303012,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -297195,8 +303059,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -297211,8 +303076,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -297227,7 +303093,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -297244,7 +303111,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -297450,7 +303318,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -297543,7 +303411,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -297736,8 +303604,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -297897,9 +303766,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -297990,8 +303870,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -298033,7 +303913,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -298060,8 +303942,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -298107,8 +303989,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -298123,8 +304006,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -298139,7 +304023,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -298156,7 +304041,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -298362,7 +304248,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -298455,7 +304341,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -298648,8 +304534,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -298809,9 +304696,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -298902,8 +304800,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -298945,7 +304843,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -298972,8 +304872,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -299019,8 +304919,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -299035,8 +304936,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -299051,7 +304953,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -299068,7 +304971,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -299274,7 +305178,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -299367,7 +305271,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -299560,8 +305464,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -299721,9 +305626,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -299814,8 +305730,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -299857,7 +305773,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -299884,8 +305802,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -299931,8 +305849,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -299947,8 +305866,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -299963,7 +305883,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -299980,7 +305901,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -300186,7 +306108,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -300279,7 +306201,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -300472,8 +306394,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -300633,9 +306556,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -300726,8 +306660,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -300769,7 +306703,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -300796,8 +306732,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -300843,8 +306779,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -300859,8 +306796,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -300875,7 +306813,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -300892,7 +306831,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -301098,7 +307038,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -301191,7 +307131,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -301384,8 +307324,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -301545,9 +307486,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -301638,8 +307590,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -301681,7 +307633,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -301708,8 +307662,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -301755,8 +307709,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -301771,8 +307726,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -301787,7 +307743,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -301804,7 +307761,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -302010,7 +307968,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -302103,7 +308061,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -302296,8 +308254,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -302457,9 +308416,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -302550,8 +308520,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -302593,7 +308563,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -302620,8 +308592,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -302667,8 +308639,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -302683,8 +308656,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -302699,7 +308673,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -302716,7 +308691,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -302922,7 +308898,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -303015,7 +308991,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -303208,8 +309184,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -303369,9 +309346,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -303462,8 +309450,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -303505,7 +309493,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -303532,8 +309522,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -303579,8 +309569,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -303595,8 +309586,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -303611,7 +309603,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -303628,7 +309621,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -303834,7 +309828,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -303927,7 +309921,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -304120,8 +310114,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -304281,9 +310276,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -304374,8 +310380,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -304417,7 +310423,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -304444,8 +310452,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -304491,8 +310499,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -304507,8 +310516,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -304523,7 +310533,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -304540,7 +310551,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -304746,7 +310758,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -304839,7 +310851,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -305032,8 +311044,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -305193,9 +311206,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -305286,8 +311310,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -305329,7 +311353,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -305356,8 +311382,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -305403,8 +311429,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -305419,8 +311446,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -305435,7 +311463,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -305452,7 +311481,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -305658,7 +311688,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -305751,7 +311781,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -305944,8 +311974,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -306105,9 +312136,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -306198,8 +312240,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -306241,7 +312283,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -306268,8 +312312,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -306315,8 +312359,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -306331,8 +312376,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -306347,7 +312393,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -306364,7 +312411,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -306570,7 +312618,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -306663,7 +312711,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -306856,8 +312904,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -307017,9 +313066,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -307110,8 +313170,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -307153,7 +313213,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -307180,8 +313242,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -307227,8 +313289,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -307243,8 +313306,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -307259,7 +313323,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -307276,7 +313341,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -307482,7 +313548,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -307575,7 +313641,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -307768,8 +313834,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -307929,9 +313996,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -308022,8 +314100,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -308065,7 +314143,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -308092,8 +314172,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -308139,8 +314219,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -308155,8 +314236,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -308171,7 +314253,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -308188,7 +314271,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -308394,7 +314478,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -308487,7 +314571,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -308680,8 +314764,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -308841,9 +314926,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -308934,8 +315030,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -308977,7 +315073,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -309004,8 +315102,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -309051,8 +315149,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -309067,8 +315166,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -309083,7 +315183,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -309100,7 +315201,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -309306,7 +315408,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -309399,7 +315501,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -309592,8 +315694,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -309753,9 +315856,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -309846,8 +315960,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -309889,7 +316003,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -309916,8 +316032,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -309963,8 +316079,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -309979,8 +316096,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -309995,7 +316113,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -310012,7 +316131,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -310218,7 +316338,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -310311,7 +316431,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -310504,8 +316624,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -310665,9 +316786,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -310758,8 +316890,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -310801,7 +316933,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -310828,8 +316962,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -310875,8 +317009,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -310891,8 +317026,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -310907,7 +317043,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -310924,7 +317061,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -311130,7 +317268,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -311223,7 +317361,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -311416,8 +317554,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -311577,9 +317716,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -311670,8 +317820,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -311713,7 +317863,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -311740,8 +317892,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -311787,8 +317939,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -311803,8 +317956,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -311819,7 +317973,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -311836,7 +317991,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -312042,7 +318198,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -312135,7 +318291,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -312328,8 +318484,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -312489,9 +318646,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -312582,8 +318750,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -312625,7 +318793,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -312652,8 +318822,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -312699,8 +318869,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -312715,8 +318886,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -312731,7 +318903,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -312748,7 +318921,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -312954,7 +319128,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -313047,7 +319221,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -313240,8 +319414,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -313401,9 +319576,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -313494,8 +319680,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -313537,7 +319723,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -313564,8 +319752,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -313611,8 +319799,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -313627,8 +319816,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -313643,7 +319833,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -313660,7 +319851,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -313866,7 +320058,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -313959,7 +320151,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -314152,8 +320344,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -314313,9 +320506,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -314406,8 +320610,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -314449,7 +320653,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -314476,8 +320682,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -314523,8 +320729,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -314539,8 +320746,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -314555,7 +320763,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -314572,7 +320781,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -314778,7 +320988,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -314871,7 +321081,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -315064,8 +321274,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -315225,9 +321436,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -315318,8 +321540,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -315361,7 +321583,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -315388,8 +321612,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -315435,8 +321659,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -315451,8 +321676,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -315467,7 +321693,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -315484,7 +321711,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -315690,7 +321918,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -315783,7 +322011,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -315976,8 +322204,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -316137,9 +322366,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -316230,8 +322470,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -316273,7 +322513,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -316300,8 +322542,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -316347,8 +322589,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -316363,8 +322606,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -316379,7 +322623,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -316396,7 +322641,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -316602,7 +322848,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -316695,7 +322941,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -316888,8 +323134,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -317049,9 +323296,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -317142,8 +323400,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -317185,7 +323443,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -317212,8 +323472,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -317259,8 +323519,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -317275,8 +323536,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -317291,7 +323553,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -317308,7 +323571,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -317514,7 +323778,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -317607,7 +323871,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -317800,8 +324064,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -317961,9 +324226,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -318054,8 +324330,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -318097,7 +324373,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -318124,8 +324402,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -318171,8 +324449,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -318187,8 +324466,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -318203,7 +324483,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -318220,7 +324501,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -318426,7 +324708,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -318519,7 +324801,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -318712,8 +324994,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -318873,9 +325156,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -318966,8 +325260,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -319009,7 +325303,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -319036,8 +325332,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -319083,8 +325379,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -319099,8 +325396,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -319115,7 +325413,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -319132,7 +325431,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -319338,7 +325638,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -319431,7 +325731,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -319624,8 +325924,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -319785,9 +326086,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -319878,8 +326190,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -319921,7 +326233,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -319948,8 +326262,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -319995,8 +326309,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -320011,8 +326326,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -320027,7 +326343,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -320044,7 +326361,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -320250,7 +326568,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -320343,7 +326661,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -320536,8 +326854,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -320697,9 +327016,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -320790,8 +327120,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -320833,7 +327163,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -320860,8 +327192,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -320907,8 +327239,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -320923,8 +327256,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -320939,7 +327273,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -320956,7 +327291,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 diff --git a/docs/mitre-map/coverage.json b/docs/mitre-map/coverage.json index 8690e27733..a154cc4c8e 100644 --- a/docs/mitre-map/coverage.json +++ b/docs/mitre-map/coverage.json @@ -563,8 +563,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -783,8 +783,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -880,7 +880,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -938,7 +938,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -973,7 +977,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -1038,8 +1042,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -1071,8 +1075,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -1091,8 +1095,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -1111,8 +1115,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -1745,8 +1749,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -1965,8 +1969,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -2062,7 +2066,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -2120,7 +2124,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -2155,7 +2163,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -2220,8 +2228,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -2253,8 +2261,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -2273,8 +2281,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -2293,8 +2301,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -2927,8 +2935,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -3147,8 +3155,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -3244,7 +3252,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -3302,7 +3310,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -3337,7 +3349,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -3402,8 +3414,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -3435,8 +3447,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -3455,8 +3467,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -3475,8 +3487,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -4109,8 +4121,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -4329,8 +4341,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -4426,7 +4438,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -4484,7 +4496,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -4519,7 +4535,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -4584,8 +4600,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -4617,8 +4633,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -4637,8 +4653,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -4657,8 +4673,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -5291,8 +5307,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -5511,8 +5527,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -5608,7 +5624,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -5666,7 +5682,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -5701,7 +5721,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -5766,8 +5786,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -5799,8 +5819,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -5819,8 +5839,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -5839,8 +5859,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -6473,8 +6493,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -6693,8 +6713,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -6790,7 +6810,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -6848,7 +6868,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -6883,7 +6907,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -6948,8 +6972,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -6981,8 +7005,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -7001,8 +7025,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -7021,8 +7045,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -7655,8 +7679,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -7875,8 +7899,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -7972,7 +7996,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -8030,7 +8054,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -8065,7 +8093,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -8130,8 +8158,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -8163,8 +8191,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -8183,8 +8211,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -8203,8 +8231,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -8837,8 +8865,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -9057,8 +9085,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -9154,7 +9182,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -9212,7 +9240,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -9247,7 +9279,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -9312,8 +9344,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -9345,8 +9377,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -9365,8 +9397,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -9385,8 +9417,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -10019,8 +10051,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -10239,8 +10271,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -10336,7 +10368,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -10394,7 +10426,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -10429,7 +10465,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -10494,8 +10530,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -10527,8 +10563,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -10547,8 +10583,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -10567,8 +10603,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -11201,8 +11237,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -11421,8 +11457,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -11518,7 +11554,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -11576,7 +11612,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -11611,7 +11651,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -11676,8 +11716,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -11709,8 +11749,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -11729,8 +11769,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -11749,8 +11789,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -12383,8 +12423,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -12603,8 +12643,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -12700,7 +12740,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -12758,7 +12798,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -12793,7 +12837,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -12858,8 +12902,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -12891,8 +12935,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -12911,8 +12955,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -12931,8 +12975,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -13565,8 +13609,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -13785,8 +13829,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -13882,7 +13926,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -13940,7 +13984,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -13975,7 +14023,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -14040,8 +14088,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -14073,8 +14121,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -14093,8 +14141,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -14113,8 +14161,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -14747,8 +14795,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -14967,8 +15015,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -15064,7 +15112,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -15122,7 +15170,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -15157,7 +15209,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -15222,8 +15274,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -15255,8 +15307,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -15275,8 +15327,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -15295,8 +15347,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -15929,8 +15981,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -16149,8 +16201,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -16246,7 +16298,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -16304,7 +16356,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -16339,7 +16395,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -16404,8 +16460,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -16437,8 +16493,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -16457,8 +16513,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -16477,8 +16533,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -17111,8 +17167,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -17331,8 +17387,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -17428,7 +17484,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -17486,7 +17542,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -17521,7 +17581,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -17586,8 +17646,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -17619,8 +17679,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -17639,8 +17699,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -17659,8 +17719,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -18293,8 +18353,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -18513,8 +18573,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -18610,7 +18670,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -18668,7 +18728,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -18703,7 +18767,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -18768,8 +18832,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -18801,8 +18865,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -18821,8 +18885,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -18841,8 +18905,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -19475,8 +19539,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -19695,8 +19759,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -19792,7 +19856,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -19850,7 +19914,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -19885,7 +19953,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -19950,8 +20018,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -19983,8 +20051,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -20003,8 +20071,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -20023,8 +20091,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -20657,8 +20725,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -20877,8 +20945,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -20974,7 +21042,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -21032,7 +21100,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -21067,7 +21139,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -21132,8 +21204,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -21165,8 +21237,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -21185,8 +21257,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -21205,8 +21277,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -21839,8 +21911,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -22059,8 +22131,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -22156,7 +22228,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -22214,7 +22286,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -22249,7 +22325,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -22314,8 +22390,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -22347,8 +22423,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -22367,8 +22443,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -22387,8 +22463,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -23021,8 +23097,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -23241,8 +23317,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -23338,7 +23414,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -23396,7 +23472,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -23431,7 +23511,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -23496,8 +23576,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -23529,8 +23609,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -23549,8 +23629,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -23569,8 +23649,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -24203,8 +24283,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -24423,8 +24503,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -24520,7 +24600,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -24578,7 +24658,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -24613,7 +24697,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -24678,8 +24762,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -24711,8 +24795,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -24731,8 +24815,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -24751,8 +24835,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -25385,8 +25469,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -25605,8 +25689,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -25702,7 +25786,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -25760,7 +25844,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -25795,7 +25883,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -25860,8 +25948,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -25893,8 +25981,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -25913,8 +26001,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -25933,8 +26021,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -26567,8 +26655,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -26787,8 +26875,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -26884,7 +26972,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -26942,7 +27030,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -26977,7 +27069,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -27042,8 +27134,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -27075,8 +27167,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -27095,8 +27187,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -27115,8 +27207,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -27749,8 +27841,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -27969,8 +28061,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -28066,7 +28158,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -28124,7 +28216,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -28159,7 +28255,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -28224,8 +28320,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -28257,8 +28353,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -28277,8 +28373,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -28297,8 +28393,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -28931,8 +29027,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -29151,8 +29247,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -29248,7 +29344,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -29306,7 +29402,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -29341,7 +29441,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -29406,8 +29506,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -29439,8 +29539,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -29459,8 +29559,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -29479,8 +29579,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -30113,8 +30213,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -30333,8 +30433,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -30430,7 +30530,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -30488,7 +30588,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -30523,7 +30627,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -30588,8 +30692,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -30621,8 +30725,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -30641,8 +30745,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -30661,8 +30765,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -31295,8 +31399,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -31515,8 +31619,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -31612,7 +31716,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -31670,7 +31774,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -31705,7 +31813,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -31770,8 +31878,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -31803,8 +31911,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -31823,8 +31931,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -31843,8 +31951,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -32477,8 +32585,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -32697,8 +32805,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -32794,7 +32902,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -32852,7 +32960,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -32887,7 +32999,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -32952,8 +33064,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -32985,8 +33097,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -33005,8 +33117,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -33025,8 +33137,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -33659,8 +33771,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -33879,8 +33991,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -33976,7 +34088,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -34034,7 +34146,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -34069,7 +34185,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -34134,8 +34250,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -34167,8 +34283,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -34187,8 +34303,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -34207,8 +34323,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -34841,8 +34957,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -35061,8 +35177,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -35158,7 +35274,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -35216,7 +35332,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -35251,7 +35371,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -35316,8 +35436,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -35349,8 +35469,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -35369,8 +35489,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -35389,8 +35509,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -36023,8 +36143,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -36243,8 +36363,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -36340,7 +36460,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -36398,7 +36518,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -36433,7 +36557,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -36498,8 +36622,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -36531,8 +36655,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -36551,8 +36675,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -36571,8 +36695,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -37205,8 +37329,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -37425,8 +37549,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -37522,7 +37646,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -37580,7 +37704,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -37615,7 +37743,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -37680,8 +37808,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -37713,8 +37841,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -37733,8 +37861,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -37753,8 +37881,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -38387,8 +38515,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -38607,8 +38735,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -38704,7 +38832,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -38762,7 +38890,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -38797,7 +38929,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -38862,8 +38994,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -38895,8 +39027,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -38915,8 +39047,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -38935,8 +39067,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -39569,8 +39701,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -39789,8 +39921,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -39886,7 +40018,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -39944,7 +40076,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -39979,7 +40115,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -40044,8 +40180,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -40077,8 +40213,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -40097,8 +40233,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -40117,8 +40253,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -40751,8 +40887,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -40971,8 +41107,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -41068,7 +41204,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -41126,7 +41262,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -41161,7 +41301,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -41226,8 +41366,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -41259,8 +41399,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -41279,8 +41419,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -41299,8 +41439,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -41933,8 +42073,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -42153,8 +42293,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -42250,7 +42390,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -42308,7 +42448,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -42343,7 +42487,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -42408,8 +42552,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -42441,8 +42585,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -42461,8 +42605,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -42481,8 +42625,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -43115,8 +43259,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -43335,8 +43479,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -43432,7 +43576,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -43490,7 +43634,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -43525,7 +43673,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -43590,8 +43738,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -43623,8 +43771,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -43643,8 +43791,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -43663,8 +43811,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -44297,8 +44445,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -44517,8 +44665,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -44614,7 +44762,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -44672,7 +44820,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -44707,7 +44859,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -44772,8 +44924,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -44805,8 +44957,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -44825,8 +44977,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -44845,8 +44997,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -45479,8 +45631,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -45699,8 +45851,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -45796,7 +45948,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -45854,7 +46006,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -45889,7 +46045,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -45954,8 +46110,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -45987,8 +46143,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -46007,8 +46163,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -46027,8 +46183,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -46661,8 +46817,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -46881,8 +47037,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -46978,7 +47134,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -47036,7 +47192,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -47071,7 +47231,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -47136,8 +47296,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -47169,8 +47329,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -47189,8 +47349,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -47209,8 +47369,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -47843,8 +48003,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -48063,8 +48223,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -48160,7 +48320,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -48218,7 +48378,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -48253,7 +48417,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -48318,8 +48482,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -48351,8 +48515,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -48371,8 +48535,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -48391,8 +48555,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -49025,8 +49189,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -49245,8 +49409,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -49342,7 +49506,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -49400,7 +49564,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -49435,7 +49603,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -49500,8 +49668,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -49533,8 +49701,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -49553,8 +49721,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -49573,8 +49741,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -50207,8 +50375,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -50427,8 +50595,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -50524,7 +50692,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -50582,7 +50750,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -50617,7 +50789,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -50682,8 +50854,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -50715,8 +50887,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -50735,8 +50907,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -50755,8 +50927,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -51389,8 +51561,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -51609,8 +51781,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -51706,7 +51878,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -51764,7 +51936,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -51799,7 +51975,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -51864,8 +52040,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -51897,8 +52073,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -51917,8 +52093,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -51937,8 +52113,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -52571,8 +52747,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -52791,8 +52967,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -52888,7 +53064,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -52946,7 +53122,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -52981,7 +53161,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -53046,8 +53226,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -53079,8 +53259,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -53099,8 +53279,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -53119,8 +53299,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -53753,8 +53933,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -53973,8 +54153,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -54070,7 +54250,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -54128,7 +54308,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -54163,7 +54347,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -54228,8 +54412,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -54261,8 +54445,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -54281,8 +54465,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -54301,8 +54485,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -54935,8 +55119,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -55155,8 +55339,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -55252,7 +55436,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -55310,7 +55494,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -55345,7 +55533,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -55410,8 +55598,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -55443,8 +55631,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -55463,8 +55651,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -55483,8 +55671,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -56117,8 +56305,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -56337,8 +56525,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -56434,7 +56622,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -56492,7 +56680,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -56527,7 +56719,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -56592,8 +56784,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -56625,8 +56817,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -56645,8 +56837,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -56665,8 +56857,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -57299,8 +57491,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -57519,8 +57711,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -57616,7 +57808,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -57674,7 +57866,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -57709,7 +57905,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -57774,8 +57970,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -57807,8 +58003,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -57827,8 +58023,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -57847,8 +58043,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -58481,8 +58677,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -58701,8 +58897,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -58798,7 +58994,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -58856,7 +59052,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -58891,7 +59091,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -58956,8 +59156,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -58989,8 +59189,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -59009,8 +59209,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -59029,8 +59229,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -59663,8 +59863,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -59883,8 +60083,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -59980,7 +60180,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -60038,7 +60238,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -60073,7 +60277,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -60138,8 +60342,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -60171,8 +60375,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -60191,8 +60395,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -60211,8 +60415,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -60845,8 +61049,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -61065,8 +61269,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -61162,7 +61366,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -61220,7 +61424,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -61255,7 +61463,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -61320,8 +61528,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -61353,8 +61561,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -61373,8 +61581,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -61393,8 +61601,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -62027,8 +62235,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -62247,8 +62455,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -62344,7 +62552,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -62402,7 +62610,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -62437,7 +62649,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -62502,8 +62714,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -62535,8 +62747,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -62555,8 +62767,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -62575,8 +62787,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -63209,8 +63421,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -63429,8 +63641,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -63526,7 +63738,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -63584,7 +63796,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -63619,7 +63835,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -63684,8 +63900,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -63717,8 +63933,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -63737,8 +63953,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -63757,8 +63973,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -64391,8 +64607,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -64611,8 +64827,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -64708,7 +64924,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -64766,7 +64982,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -64801,7 +65021,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -64866,8 +65086,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -64899,8 +65119,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -64919,8 +65139,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -64939,8 +65159,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -65573,8 +65793,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -65793,8 +66013,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -65890,7 +66110,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -65948,7 +66168,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -65983,7 +66207,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -66048,8 +66272,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -66081,8 +66305,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -66101,8 +66325,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -66121,8 +66345,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -66755,8 +66979,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -66975,8 +67199,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -67072,7 +67296,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -67130,7 +67354,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -67165,7 +67393,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -67230,8 +67458,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -67263,8 +67491,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -67283,8 +67511,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -67303,8 +67531,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -67937,8 +68165,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -68157,8 +68385,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -68254,7 +68482,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -68312,7 +68540,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -68347,7 +68579,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -68412,8 +68644,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -68445,8 +68677,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -68465,8 +68697,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -68485,8 +68717,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -69119,8 +69351,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -69339,8 +69571,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -69436,7 +69668,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -69494,7 +69726,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -69529,7 +69765,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -69594,8 +69830,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -69627,8 +69863,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -69647,8 +69883,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -69667,8 +69903,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -70301,8 +70537,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -70521,8 +70757,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -70618,7 +70854,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -70676,7 +70912,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -70711,7 +70951,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -70776,8 +71016,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -70809,8 +71049,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -70829,8 +71069,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -70849,8 +71089,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -71483,8 +71723,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -71703,8 +71943,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -71800,7 +72040,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -71858,7 +72098,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -71893,7 +72137,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -71958,8 +72202,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -71991,8 +72235,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -72011,8 +72255,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -72031,8 +72275,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -72665,8 +72909,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -72885,8 +73129,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -72982,7 +73226,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -73040,7 +73284,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -73075,7 +73323,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -73140,8 +73388,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -73173,8 +73421,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -73193,8 +73441,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -73213,8 +73461,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -73847,8 +74095,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -74067,8 +74315,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -74164,7 +74412,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -74222,7 +74470,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -74257,7 +74509,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -74322,8 +74574,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -74355,8 +74607,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -74375,8 +74627,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -74395,8 +74647,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -75029,8 +75281,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -75249,8 +75501,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -75346,7 +75598,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -75404,7 +75656,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -75439,7 +75695,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -75504,8 +75760,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -75537,8 +75793,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -75557,8 +75813,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -75577,8 +75833,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -76211,8 +76467,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -76431,8 +76687,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -76528,7 +76784,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -76586,7 +76842,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -76621,7 +76881,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -76686,8 +76946,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -76719,8 +76979,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -76739,8 +76999,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -76759,8 +77019,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -77393,8 +77653,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -77613,8 +77873,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -77710,7 +77970,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -77768,7 +78028,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -77803,7 +78067,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -77868,8 +78132,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -77901,8 +78165,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -77921,8 +78185,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -77941,8 +78205,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -78575,8 +78839,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -78795,8 +79059,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -78892,7 +79156,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -78950,7 +79214,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -78985,7 +79253,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -79050,8 +79318,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -79083,8 +79351,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -79103,8 +79371,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -79123,8 +79391,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -79757,8 +80025,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -79977,8 +80245,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -80074,7 +80342,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -80132,7 +80400,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -80167,7 +80439,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -80232,8 +80504,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -80265,8 +80537,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -80285,8 +80557,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -80305,8 +80577,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -80939,8 +81211,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -81159,8 +81431,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -81256,7 +81528,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -81314,7 +81586,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -81349,7 +81625,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -81414,8 +81690,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -81447,8 +81723,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -81467,8 +81743,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -81487,8 +81763,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -82121,8 +82397,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -82341,8 +82617,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -82438,7 +82714,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -82496,7 +82772,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -82531,7 +82811,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -82596,8 +82876,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -82629,8 +82909,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -82649,8 +82929,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -82669,8 +82949,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -83303,8 +83583,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -83523,8 +83803,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -83620,7 +83900,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -83678,7 +83958,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -83713,7 +83997,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -83778,8 +84062,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -83811,8 +84095,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -83831,8 +84115,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -83851,8 +84135,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -84485,8 +84769,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -84705,8 +84989,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -84802,7 +85086,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -84860,7 +85144,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -84895,7 +85183,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -84960,8 +85248,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -84993,8 +85281,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -85013,8 +85301,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -85033,8 +85321,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -85667,8 +85955,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -85887,8 +86175,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -85984,7 +86272,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -86042,7 +86330,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -86077,7 +86369,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -86142,8 +86434,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -86175,8 +86467,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -86195,8 +86487,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -86215,8 +86507,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -86849,8 +87141,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -87069,8 +87361,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -87166,7 +87458,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -87224,7 +87516,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -87259,7 +87555,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -87324,8 +87620,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -87357,8 +87653,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -87377,8 +87673,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -87397,8 +87693,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -88031,8 +88327,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -88251,8 +88547,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -88348,7 +88644,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -88406,7 +88702,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -88441,7 +88741,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -88506,8 +88806,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -88539,8 +88839,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -88559,8 +88859,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -88579,8 +88879,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -89213,8 +89513,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -89433,8 +89733,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -89530,7 +89830,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -89588,7 +89888,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -89623,7 +89927,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -89688,8 +89992,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -89721,8 +90025,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -89741,8 +90045,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -89761,8 +90065,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -90395,8 +90699,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -90615,8 +90919,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -90712,7 +91016,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -90770,7 +91074,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -90805,7 +91113,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -90870,8 +91178,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -90903,8 +91211,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -90923,8 +91231,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -90943,8 +91251,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -91577,8 +91885,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -91797,8 +92105,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -91894,7 +92202,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -91952,7 +92260,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -91987,7 +92299,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -92052,8 +92364,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -92085,8 +92397,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -92105,8 +92417,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -92125,8 +92437,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -92759,8 +93071,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -92979,8 +93291,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -93076,7 +93388,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -93134,7 +93446,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -93169,7 +93485,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -93234,8 +93550,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -93267,8 +93583,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -93287,8 +93603,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -93307,8 +93623,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -93941,8 +94257,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -94161,8 +94477,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -94258,7 +94574,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -94316,7 +94632,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -94351,7 +94671,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -94416,8 +94736,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -94449,8 +94769,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -94469,8 +94789,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -94489,8 +94809,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -95123,8 +95443,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -95343,8 +95663,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -95440,7 +95760,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -95498,7 +95818,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -95533,7 +95857,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -95598,8 +95922,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -95631,8 +95955,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -95651,8 +95975,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -95671,8 +95995,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -96305,8 +96629,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -96525,8 +96849,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -96622,7 +96946,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -96680,7 +97004,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -96715,7 +97043,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -96780,8 +97108,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -96813,8 +97141,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -96833,8 +97161,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -96853,8 +97181,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -97487,8 +97815,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -97707,8 +98035,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -97804,7 +98132,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -97862,7 +98190,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -97897,7 +98229,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -97962,8 +98294,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -97995,8 +98327,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -98015,8 +98347,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -98035,8 +98367,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -98669,8 +99001,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -98889,8 +99221,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -98986,7 +99318,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -99044,7 +99376,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -99079,7 +99415,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -99144,8 +99480,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -99177,8 +99513,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -99197,8 +99533,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -99217,8 +99553,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -99851,8 +100187,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -100071,8 +100407,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -100168,7 +100504,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -100226,7 +100562,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -100261,7 +100601,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -100326,8 +100666,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -100359,8 +100699,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -100379,8 +100719,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -100399,8 +100739,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -101033,8 +101373,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -101253,8 +101593,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -101350,7 +101690,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -101408,7 +101748,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -101443,7 +101787,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -101508,8 +101852,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -101541,8 +101885,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -101561,8 +101905,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -101581,8 +101925,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -102215,8 +102559,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -102435,8 +102779,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -102532,7 +102876,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -102590,7 +102934,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -102625,7 +102973,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -102690,8 +103038,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -102723,8 +103071,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -102743,8 +103091,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -102763,8 +103111,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -103397,8 +103745,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -103617,8 +103965,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -103714,7 +104062,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -103772,7 +104120,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -103807,7 +104159,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -103872,8 +104224,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -103905,8 +104257,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -103925,8 +104277,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -103945,8 +104297,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -104579,8 +104931,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -104799,8 +105151,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -104896,7 +105248,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -104954,7 +105306,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -104989,7 +105345,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -105054,8 +105410,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -105087,8 +105443,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -105107,8 +105463,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -105127,8 +105483,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -105761,8 +106117,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -105981,8 +106337,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -106078,7 +106434,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -106136,7 +106492,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -106171,7 +106531,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -106236,8 +106596,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -106269,8 +106629,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -106289,8 +106649,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -106309,8 +106669,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -106943,8 +107303,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -107163,8 +107523,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -107260,7 +107620,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -107318,7 +107678,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -107353,7 +107717,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -107418,8 +107782,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -107451,8 +107815,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -107471,8 +107835,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -107491,8 +107855,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -108125,8 +108489,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -108345,8 +108709,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -108442,7 +108806,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -108500,7 +108864,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -108535,7 +108903,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -108600,8 +108968,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -108633,8 +109001,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -108653,8 +109021,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -108673,8 +109041,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -109307,8 +109675,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -109527,8 +109895,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -109624,7 +109992,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -109682,7 +110050,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -109717,7 +110089,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -109782,8 +110154,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -109815,8 +110187,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -109835,8 +110207,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -109855,8 +110227,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -110489,8 +110861,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -110709,8 +111081,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -110806,7 +111178,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -110864,7 +111236,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -110899,7 +111275,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -110964,8 +111340,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -110997,8 +111373,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -111017,8 +111393,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -111037,8 +111413,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -111671,8 +112047,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -111891,8 +112267,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -111988,7 +112364,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -112046,7 +112422,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -112081,7 +112461,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -112146,8 +112526,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -112179,8 +112559,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -112199,8 +112579,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -112219,8 +112599,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -112853,8 +113233,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -113073,8 +113453,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -113170,7 +113550,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -113228,7 +113608,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -113263,7 +113647,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -113328,8 +113712,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -113361,8 +113745,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -113381,8 +113765,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -113401,8 +113785,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -114035,8 +114419,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -114255,8 +114639,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -114352,7 +114736,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -114410,7 +114794,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -114445,7 +114833,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -114510,8 +114898,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -114543,8 +114931,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -114563,8 +114951,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -114583,8 +114971,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -115217,8 +115605,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -115437,8 +115825,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -115534,7 +115922,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -115592,7 +115980,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -115627,7 +116019,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -115692,8 +116084,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -115725,8 +116117,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -115745,8 +116137,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -115765,8 +116157,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -116399,8 +116791,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -116619,8 +117011,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -116716,7 +117108,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -116774,7 +117166,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -116809,7 +117205,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -116874,8 +117270,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -116907,8 +117303,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -116927,8 +117323,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -116947,8 +117343,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -117581,8 +117977,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -117801,8 +118197,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -117898,7 +118294,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -117956,7 +118352,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -117991,7 +118391,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -118056,8 +118456,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -118089,8 +118489,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -118109,8 +118509,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -118129,8 +118529,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -118763,8 +119163,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -118983,8 +119383,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -119080,7 +119480,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -119138,7 +119538,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -119173,7 +119577,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -119238,8 +119642,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -119271,8 +119675,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -119291,8 +119695,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -119311,8 +119715,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -119945,8 +120349,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -120165,8 +120569,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -120262,7 +120666,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -120320,7 +120724,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -120355,7 +120763,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -120420,8 +120828,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -120453,8 +120861,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -120473,8 +120881,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -120493,8 +120901,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -121127,8 +121535,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -121347,8 +121755,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -121444,7 +121852,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -121502,7 +121910,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -121537,7 +121949,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -121602,8 +122014,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -121635,8 +122047,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -121655,8 +122067,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -121675,8 +122087,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -122309,8 +122721,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -122529,8 +122941,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -122626,7 +123038,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -122684,7 +123096,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -122719,7 +123135,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -122784,8 +123200,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -122817,8 +123233,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -122837,8 +123253,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -122857,8 +123273,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -123491,8 +123907,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -123711,8 +124127,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -123808,7 +124224,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -123866,7 +124282,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -123901,7 +124321,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -123966,8 +124386,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -123999,8 +124419,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -124019,8 +124439,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -124039,8 +124459,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -124673,8 +125093,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -124893,8 +125313,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -124990,7 +125410,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -125048,7 +125468,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -125083,7 +125507,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -125148,8 +125572,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -125181,8 +125605,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -125201,8 +125625,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -125221,8 +125645,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -125855,8 +126279,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -126075,8 +126499,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -126172,7 +126596,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -126230,7 +126654,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -126265,7 +126693,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -126330,8 +126758,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -126363,8 +126791,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -126383,8 +126811,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -126403,8 +126831,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -127037,8 +127465,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -127257,8 +127685,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -127354,7 +127782,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -127412,7 +127840,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -127447,7 +127879,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -127512,8 +127944,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -127545,8 +127977,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -127565,8 +127997,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -127585,8 +128017,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -128219,8 +128651,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -128439,8 +128871,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -128536,7 +128968,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -128594,7 +129026,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -128629,7 +129065,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -128694,8 +129130,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -128727,8 +129163,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -128747,8 +129183,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -128767,8 +129203,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -129401,8 +129837,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -129621,8 +130057,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -129718,7 +130154,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -129776,7 +130212,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -129811,7 +130251,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -129876,8 +130316,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -129909,8 +130349,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -129929,8 +130369,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -129949,8 +130389,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -130583,8 +131023,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -130803,8 +131243,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -130900,7 +131340,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -130958,7 +131398,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -130993,7 +131437,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -131058,8 +131502,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -131091,8 +131535,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -131111,8 +131555,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -131131,8 +131575,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -131765,8 +132209,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -131985,8 +132429,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -132082,7 +132526,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -132140,7 +132584,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -132175,7 +132623,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -132240,8 +132688,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -132273,8 +132721,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -132293,8 +132741,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -132313,8 +132761,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -132947,8 +133395,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -133167,8 +133615,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -133264,7 +133712,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -133322,7 +133770,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -133357,7 +133809,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -133422,8 +133874,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -133455,8 +133907,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -133475,8 +133927,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -133495,8 +133947,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -134129,8 +134581,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -134349,8 +134801,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -134446,7 +134898,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -134504,7 +134956,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -134539,7 +134995,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -134604,8 +135060,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -134637,8 +135093,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -134657,8 +135113,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -134677,8 +135133,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -135311,8 +135767,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -135531,8 +135987,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -135628,7 +136084,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -135686,7 +136142,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -135721,7 +136181,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -135786,8 +136246,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -135819,8 +136279,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -135839,8 +136299,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -135859,8 +136319,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -136493,8 +136953,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -136713,8 +137173,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -136810,7 +137270,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -136868,7 +137328,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -136903,7 +137367,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -136968,8 +137432,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -137001,8 +137465,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -137021,8 +137485,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -137041,8 +137505,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -137675,8 +138139,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -137895,8 +138359,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -137992,7 +138456,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -138050,7 +138514,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -138085,7 +138553,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -138150,8 +138618,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -138183,8 +138651,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -138203,8 +138671,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -138223,8 +138691,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -138857,8 +139325,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -139077,8 +139545,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -139174,7 +139642,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -139232,7 +139700,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -139267,7 +139739,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -139332,8 +139804,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -139365,8 +139837,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -139385,8 +139857,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -139405,8 +139877,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -140039,8 +140511,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -140259,8 +140731,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -140356,7 +140828,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -140414,7 +140886,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -140449,7 +140925,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -140514,8 +140990,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -140547,8 +141023,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -140567,8 +141043,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -140587,8 +141063,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -141221,8 +141697,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -141441,8 +141917,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -141538,7 +142014,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -141596,7 +142072,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -141631,7 +142111,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -141696,8 +142176,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -141729,8 +142209,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -141749,8 +142229,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -141769,8 +142249,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -142403,8 +142883,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -142623,8 +143103,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -142720,7 +143200,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -142778,7 +143258,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -142813,7 +143297,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -142878,8 +143362,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -142911,8 +143395,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -142931,8 +143415,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -142951,8 +143435,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -143585,8 +144069,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -143805,8 +144289,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -143902,7 +144386,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -143960,7 +144444,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -143995,7 +144483,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -144060,8 +144548,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -144093,8 +144581,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -144113,8 +144601,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -144133,8 +144621,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -144767,8 +145255,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -144987,8 +145475,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -145084,7 +145572,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -145142,7 +145630,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -145177,7 +145669,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -145242,8 +145734,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -145275,8 +145767,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -145295,8 +145787,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -145315,8 +145807,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -145949,8 +146441,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -146169,8 +146661,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -146266,7 +146758,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -146324,7 +146816,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -146359,7 +146855,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -146424,8 +146920,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -146457,8 +146953,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -146477,8 +146973,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -146497,8 +146993,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -147131,8 +147627,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -147351,8 +147847,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -147448,7 +147944,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -147506,7 +148002,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -147541,7 +148041,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -147606,8 +148106,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -147639,8 +148139,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -147659,8 +148159,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -147679,8 +148179,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -148313,8 +148813,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -148533,8 +149033,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -148630,7 +149130,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -148688,7 +149188,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -148723,7 +149227,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -148788,8 +149292,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -148821,8 +149325,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -148841,8 +149345,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -148861,8 +149365,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -149495,8 +149999,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -149715,8 +150219,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -149812,7 +150316,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -149870,7 +150374,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -149905,7 +150413,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -149970,8 +150478,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -150003,8 +150511,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -150023,8 +150531,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -150043,8 +150551,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -150677,8 +151185,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -150897,8 +151405,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -150994,7 +151502,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -151052,7 +151560,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -151087,7 +151599,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -151152,8 +151664,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -151185,8 +151697,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -151205,8 +151717,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -151225,8 +151737,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -151859,8 +152371,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -152079,8 +152591,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -152176,7 +152688,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -152234,7 +152746,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -152269,7 +152785,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -152334,8 +152850,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -152367,8 +152883,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -152387,8 +152903,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -152407,8 +152923,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -153041,8 +153557,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -153261,8 +153777,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -153358,7 +153874,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -153416,7 +153932,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -153451,7 +153971,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -153516,8 +154036,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -153549,8 +154069,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -153569,8 +154089,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -153589,8 +154109,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -154223,8 +154743,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -154443,8 +154963,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -154540,7 +155060,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -154598,7 +155118,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -154633,7 +155157,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -154698,8 +155222,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -154731,8 +155255,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -154751,8 +155275,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -154771,8 +155295,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -155405,8 +155929,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -155625,8 +156149,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -155722,7 +156246,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -155780,7 +156304,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -155815,7 +156343,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -155880,8 +156408,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -155913,8 +156441,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -155933,8 +156461,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -155953,8 +156481,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -156587,8 +157115,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -156807,8 +157335,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -156904,7 +157432,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -156962,7 +157490,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -156997,7 +157529,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -157062,8 +157594,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -157095,8 +157627,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -157115,8 +157647,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -157135,8 +157667,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -157769,8 +158301,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -157989,8 +158521,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -158086,7 +158618,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -158144,7 +158676,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -158179,7 +158715,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -158244,8 +158780,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -158277,8 +158813,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -158297,8 +158833,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -158317,8 +158853,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -158951,8 +159487,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -159171,8 +159707,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -159268,7 +159804,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -159326,7 +159862,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -159361,7 +159901,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -159426,8 +159966,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -159459,8 +159999,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -159479,8 +160019,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -159499,8 +160039,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -160133,8 +160673,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -160353,8 +160893,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -160450,7 +160990,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -160508,7 +161048,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -160543,7 +161087,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -160608,8 +161152,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -160641,8 +161185,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -160661,8 +161205,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -160681,8 +161225,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -161315,8 +161859,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -161535,8 +162079,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -161632,7 +162176,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -161690,7 +162234,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -161725,7 +162273,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -161790,8 +162338,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -161823,8 +162371,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -161843,8 +162391,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -161863,8 +162411,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -162497,8 +163045,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -162717,8 +163265,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -162814,7 +163362,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -162872,7 +163420,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -162907,7 +163459,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -162972,8 +163524,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -163005,8 +163557,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -163025,8 +163577,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -163045,8 +163597,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -163679,8 +164231,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -163899,8 +164451,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -163996,7 +164548,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -164054,7 +164606,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -164089,7 +164645,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -164154,8 +164710,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -164187,8 +164743,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -164207,8 +164763,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -164227,8 +164783,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -164861,8 +165417,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -165081,8 +165637,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -165178,7 +165734,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -165236,7 +165792,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -165271,7 +165831,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -165336,8 +165896,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -165369,8 +165929,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -165389,8 +165949,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -165409,8 +165969,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -166043,8 +166603,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -166263,8 +166823,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -166360,7 +166920,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -166418,7 +166978,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -166453,7 +167017,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -166518,8 +167082,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -166551,8 +167115,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -166571,8 +167135,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -166591,8 +167155,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -167225,8 +167789,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -167445,8 +168009,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -167542,7 +168106,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -167600,7 +168164,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -167635,7 +168203,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -167700,8 +168268,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -167733,8 +168301,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -167753,8 +168321,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -167773,8 +168341,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -168407,8 +168975,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -168627,8 +169195,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -168724,7 +169292,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -168782,7 +169350,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -168817,7 +169389,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -168882,8 +169454,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -168915,8 +169487,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -168935,8 +169507,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -168955,8 +169527,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -169589,8 +170161,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -169809,8 +170381,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -169906,7 +170478,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -169964,7 +170536,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -169999,7 +170575,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -170064,8 +170640,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -170097,8 +170673,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -170117,8 +170693,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -170137,8 +170713,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -170771,8 +171347,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -170991,8 +171567,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -171088,7 +171664,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -171146,7 +171722,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -171181,7 +171761,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -171246,8 +171826,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -171279,8 +171859,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -171299,8 +171879,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -171319,8 +171899,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -171953,8 +172533,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -172173,8 +172753,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -172270,7 +172850,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -172328,7 +172908,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -172363,7 +172947,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -172428,8 +173012,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -172461,8 +173045,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -172481,8 +173065,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -172501,8 +173085,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -173135,8 +173719,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -173355,8 +173939,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -173452,7 +174036,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -173510,7 +174094,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -173545,7 +174133,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -173610,8 +174198,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -173643,8 +174231,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -173663,8 +174251,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -173683,8 +174271,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -174317,8 +174905,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -174537,8 +175125,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -174634,7 +175222,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -174692,7 +175280,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -174727,7 +175319,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -174792,8 +175384,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -174825,8 +175417,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -174845,8 +175437,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -174865,8 +175457,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -175499,8 +176091,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -175719,8 +176311,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -175816,7 +176408,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -175874,7 +176466,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -175909,7 +176505,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -175974,8 +176570,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -176007,8 +176603,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -176027,8 +176623,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -176047,8 +176643,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -176681,8 +177277,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -176901,8 +177497,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -176998,7 +177594,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -177056,7 +177652,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -177091,7 +177691,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -177156,8 +177756,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -177189,8 +177789,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -177209,8 +177809,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -177229,8 +177829,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -177863,8 +178463,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -178083,8 +178683,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -178180,7 +178780,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -178238,7 +178838,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -178273,7 +178877,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -178338,8 +178942,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -178371,8 +178975,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -178391,8 +178995,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -178411,8 +179015,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -179045,8 +179649,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -179265,8 +179869,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -179362,7 +179966,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -179420,7 +180024,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -179455,7 +180063,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -179520,8 +180128,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -179553,8 +180161,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -179573,8 +180181,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -179593,8 +180201,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -180227,8 +180835,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -180447,8 +181055,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -180544,7 +181152,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -180602,7 +181210,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -180637,7 +181249,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -180702,8 +181314,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -180735,8 +181347,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -180755,8 +181367,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -180775,8 +181387,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -181409,8 +182021,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -181629,8 +182241,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -181726,7 +182338,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -181784,7 +182396,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -181819,7 +182435,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -181884,8 +182500,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -181917,8 +182533,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -181937,8 +182553,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -181957,8 +182573,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -182591,8 +183207,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -182811,8 +183427,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -182908,7 +183524,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -182966,7 +183582,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -183001,7 +183621,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -183066,8 +183686,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -183099,8 +183719,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -183119,8 +183739,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -183139,8 +183759,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -183773,8 +184393,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -183993,8 +184613,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -184090,7 +184710,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -184148,7 +184768,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -184183,7 +184807,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -184248,8 +184872,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -184281,8 +184905,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -184301,8 +184925,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -184321,8 +184945,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -184955,8 +185579,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -185175,8 +185799,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -185272,7 +185896,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -185330,7 +185954,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -185365,7 +185993,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -185430,8 +186058,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -185463,8 +186091,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -185483,8 +186111,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -185503,8 +186131,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -186137,8 +186765,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -186357,8 +186985,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -186454,7 +187082,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -186512,7 +187140,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -186547,7 +187179,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -186612,8 +187244,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -186645,8 +187277,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -186665,8 +187297,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -186685,8 +187317,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -187319,8 +187951,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -187539,8 +188171,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -187636,7 +188268,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -187694,7 +188326,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -187729,7 +188365,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -187794,8 +188430,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -187827,8 +188463,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -187847,8 +188483,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -187867,8 +188503,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -188501,8 +189137,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -188721,8 +189357,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -188818,7 +189454,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -188876,7 +189512,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -188911,7 +189551,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -188976,8 +189616,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -189009,8 +189649,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -189029,8 +189669,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -189049,8 +189689,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -189683,8 +190323,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -189903,8 +190543,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -190000,7 +190640,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -190058,7 +190698,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -190093,7 +190737,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -190158,8 +190802,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -190191,8 +190835,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -190211,8 +190855,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -190231,8 +190875,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -190865,8 +191509,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -191085,8 +191729,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -191182,7 +191826,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -191240,7 +191884,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -191275,7 +191923,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -191340,8 +191988,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -191373,8 +192021,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -191393,8 +192041,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -191413,8 +192061,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -192047,8 +192695,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -192267,8 +192915,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -192364,7 +193012,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -192422,7 +193070,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -192457,7 +193109,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -192522,8 +193174,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -192555,8 +193207,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -192575,8 +193227,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -192595,8 +193247,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -193229,8 +193881,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -193449,8 +194101,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -193546,7 +194198,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -193604,7 +194256,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -193639,7 +194295,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -193704,8 +194360,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -193737,8 +194393,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -193757,8 +194413,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -193777,8 +194433,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -194411,8 +195067,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -194631,8 +195287,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -194728,7 +195384,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -194786,7 +195442,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -194821,7 +195481,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -194886,8 +195546,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -194919,8 +195579,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -194939,8 +195599,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -194959,8 +195619,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -195593,8 +196253,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -195813,8 +196473,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -195910,7 +196570,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -195968,7 +196628,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -196003,7 +196667,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -196068,8 +196732,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -196101,8 +196765,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -196121,8 +196785,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -196141,8 +196805,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -196775,8 +197439,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -196995,8 +197659,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -197092,7 +197756,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -197150,7 +197814,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -197185,7 +197853,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -197250,8 +197918,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -197283,8 +197951,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -197303,8 +197971,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -197323,8 +197991,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -197957,8 +198625,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -198177,8 +198845,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -198274,7 +198942,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -198332,7 +199000,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -198367,7 +199039,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -198432,8 +199104,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -198465,8 +199137,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -198485,8 +199157,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -198505,8 +199177,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -199139,8 +199811,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -199359,8 +200031,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -199456,7 +200128,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -199514,7 +200186,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -199549,7 +200225,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -199614,8 +200290,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -199647,8 +200323,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -199667,8 +200343,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -199687,8 +200363,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -200321,8 +200997,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -200541,8 +201217,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -200638,7 +201314,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -200696,7 +201372,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -200731,7 +201411,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -200796,8 +201476,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -200829,8 +201509,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -200849,8 +201529,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -200869,8 +201549,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -201503,8 +202183,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -201723,8 +202403,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -201820,7 +202500,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -201878,7 +202558,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -201913,7 +202597,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -201978,8 +202662,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -202011,8 +202695,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -202031,8 +202715,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -202051,8 +202735,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -202685,8 +203369,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -202905,8 +203589,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -203002,7 +203686,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -203060,7 +203744,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -203095,7 +203783,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -203160,8 +203848,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -203193,8 +203881,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -203213,8 +203901,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -203233,8 +203921,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -203867,8 +204555,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -204087,8 +204775,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -204184,7 +204872,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -204242,7 +204930,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -204277,7 +204969,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -204342,8 +205034,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -204375,8 +205067,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -204395,8 +205087,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -204415,8 +205107,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -205049,8 +205741,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -205269,8 +205961,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -205366,7 +206058,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -205424,7 +206116,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -205459,7 +206155,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -205524,8 +206220,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -205557,8 +206253,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -205577,8 +206273,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -205597,8 +206293,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -206231,8 +206927,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -206451,8 +207147,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -206548,7 +207244,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -206606,7 +207302,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -206641,7 +207341,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -206706,8 +207406,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -206739,8 +207439,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -206759,8 +207459,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -206779,8 +207479,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -207413,8 +208113,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -207633,8 +208333,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -207730,7 +208430,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -207788,7 +208488,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -207823,7 +208527,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -207888,8 +208592,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -207921,8 +208625,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -207941,8 +208645,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -207961,8 +208665,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -208595,8 +209299,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -208815,8 +209519,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -208912,7 +209616,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -208970,7 +209674,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -209005,7 +209713,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -209070,8 +209778,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -209103,8 +209811,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -209123,8 +209831,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -209143,8 +209851,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -209777,8 +210485,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -209997,8 +210705,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -210094,7 +210802,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -210152,7 +210860,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -210187,7 +210899,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -210252,8 +210964,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -210285,8 +210997,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -210305,8 +211017,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -210325,8 +211037,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -210959,8 +211671,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -211179,8 +211891,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -211276,7 +211988,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -211334,7 +212046,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -211369,7 +212085,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -211434,8 +212150,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -211467,8 +212183,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -211487,8 +212203,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -211507,8 +212223,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -212141,8 +212857,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -212361,8 +213077,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -212458,7 +213174,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -212516,7 +213232,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -212551,7 +213271,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -212616,8 +213336,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -212649,8 +213369,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -212669,8 +213389,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -212689,8 +213409,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -213323,8 +214043,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -213543,8 +214263,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -213640,7 +214360,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -213698,7 +214418,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -213733,7 +214457,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -213798,8 +214522,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -213831,8 +214555,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -213851,8 +214575,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -213871,8 +214595,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -214505,8 +215229,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -214725,8 +215449,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -214822,7 +215546,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -214880,7 +215604,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -214915,7 +215643,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -214980,8 +215708,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -215013,8 +215741,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -215033,8 +215761,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -215053,8 +215781,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -215687,8 +216415,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -215907,8 +216635,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -216004,7 +216732,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -216062,7 +216790,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -216097,7 +216829,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -216162,8 +216894,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -216195,8 +216927,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -216215,8 +216947,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -216235,8 +216967,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -216869,8 +217601,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -217089,8 +217821,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -217186,7 +217918,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -217244,7 +217976,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -217279,7 +218015,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -217344,8 +218080,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -217377,8 +218113,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -217397,8 +218133,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -217417,8 +218153,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -218051,8 +218787,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -218271,8 +219007,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -218368,7 +219104,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -218426,7 +219162,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -218461,7 +219201,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -218526,8 +219266,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -218559,8 +219299,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -218579,8 +219319,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -218599,8 +219339,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -219233,8 +219973,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -219453,8 +220193,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -219550,7 +220290,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -219608,7 +220348,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -219643,7 +220387,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -219708,8 +220452,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -219741,8 +220485,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -219761,8 +220505,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -219781,8 +220525,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -220415,8 +221159,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -220635,8 +221379,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -220732,7 +221476,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -220790,7 +221534,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -220825,7 +221573,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -220890,8 +221638,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -220923,8 +221671,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -220943,8 +221691,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -220963,8 +221711,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -221597,8 +222345,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -221817,8 +222565,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -221914,7 +222662,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -221972,7 +222720,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -222007,7 +222759,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -222072,8 +222824,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -222105,8 +222857,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -222125,8 +222877,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -222145,8 +222897,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -222779,8 +223531,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -222999,8 +223751,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -223096,7 +223848,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -223154,7 +223906,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -223189,7 +223945,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -223254,8 +224010,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -223287,8 +224043,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -223307,8 +224063,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -223327,8 +224083,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -223961,8 +224717,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -224181,8 +224937,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -224278,7 +225034,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -224336,7 +225092,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -224371,7 +225131,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -224436,8 +225196,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -224469,8 +225229,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -224489,8 +225249,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -224509,8 +225269,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -225143,8 +225903,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -225363,8 +226123,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -225460,7 +226220,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -225518,7 +226278,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -225553,7 +226317,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -225618,8 +226382,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -225651,8 +226415,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -225671,8 +226435,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -225691,8 +226455,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -226325,8 +227089,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -226545,8 +227309,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -226642,7 +227406,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -226700,7 +227464,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -226735,7 +227503,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -226800,8 +227568,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -226833,8 +227601,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -226853,8 +227621,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -226873,8 +227641,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -227507,8 +228275,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -227727,8 +228495,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -227824,7 +228592,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -227882,7 +228650,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -227917,7 +228689,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -227982,8 +228754,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -228015,8 +228787,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -228035,8 +228807,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -228055,8 +228827,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -228689,8 +229461,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -228909,8 +229681,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -229006,7 +229778,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -229064,7 +229836,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -229099,7 +229875,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -229164,8 +229940,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -229197,8 +229973,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -229217,8 +229993,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -229237,8 +230013,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -229871,8 +230647,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -230091,8 +230867,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -230188,7 +230964,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -230246,7 +231022,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -230281,7 +231061,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -230346,8 +231126,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -230379,8 +231159,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -230399,8 +231179,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -230419,8 +231199,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -231053,8 +231833,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -231273,8 +232053,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -231370,7 +232150,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -231428,7 +232208,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -231463,7 +232247,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -231528,8 +232312,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -231561,8 +232345,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -231581,8 +232365,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -231601,8 +232385,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -232235,8 +233019,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -232455,8 +233239,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -232552,7 +233336,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -232610,7 +233394,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -232645,7 +233433,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -232710,8 +233498,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -232743,8 +233531,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -232763,8 +233551,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -232783,8 +233571,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -233417,8 +234205,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -233637,8 +234425,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -233734,7 +234522,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -233792,7 +234580,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -233827,7 +234619,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -233892,8 +234684,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -233925,8 +234717,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -233945,8 +234737,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -233965,8 +234757,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -234599,8 +235391,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -234819,8 +235611,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -234916,7 +235708,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -234974,7 +235766,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -235009,7 +235805,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -235074,8 +235870,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -235107,8 +235903,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -235127,8 +235923,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -235147,8 +235943,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -235781,8 +236577,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -236001,8 +236797,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -236098,7 +236894,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -236156,7 +236952,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -236191,7 +236991,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -236256,8 +237056,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -236289,8 +237089,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -236309,8 +237109,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -236329,8 +237129,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -236963,8 +237763,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -237183,8 +237983,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -237280,7 +238080,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -237338,7 +238138,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -237373,7 +238177,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -237438,8 +238242,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -237471,8 +238275,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -237491,8 +238295,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -237511,8 +238315,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -238145,8 +238949,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -238365,8 +239169,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -238462,7 +239266,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -238520,7 +239324,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -238555,7 +239363,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -238620,8 +239428,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -238653,8 +239461,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -238673,8 +239481,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -238693,8 +239501,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -239327,8 +240135,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -239547,8 +240355,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -239644,7 +240452,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -239702,7 +240510,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -239737,7 +240549,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -239802,8 +240614,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -239835,8 +240647,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -239855,8 +240667,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -239875,8 +240687,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -240509,8 +241321,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -240729,8 +241541,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -240826,7 +241638,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -240884,7 +241696,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -240919,7 +241735,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -240984,8 +241800,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -241017,8 +241833,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -241037,8 +241853,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -241057,8 +241873,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -241691,8 +242507,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -241911,8 +242727,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -242008,7 +242824,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -242066,7 +242882,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -242101,7 +242921,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -242166,8 +242986,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -242199,8 +243019,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -242219,8 +243039,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -242239,8 +243059,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -242873,8 +243693,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -243093,8 +243913,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -243190,7 +244010,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -243248,7 +244068,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -243283,7 +244107,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -243348,8 +244172,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -243381,8 +244205,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -243401,8 +244225,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -243421,8 +244245,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -244055,8 +244879,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -244275,8 +245099,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -244372,7 +245196,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -244430,7 +245254,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -244465,7 +245293,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -244530,8 +245358,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -244563,8 +245391,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -244583,8 +245411,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -244603,8 +245431,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -245237,8 +246065,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -245457,8 +246285,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -245554,7 +246382,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -245612,7 +246440,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -245647,7 +246479,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -245712,8 +246544,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -245745,8 +246577,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -245765,8 +246597,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -245785,8 +246617,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -246419,8 +247251,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -246639,8 +247471,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -246736,7 +247568,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -246794,7 +247626,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -246829,7 +247665,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -246894,8 +247730,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -246927,8 +247763,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -246947,8 +247783,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -246967,8 +247803,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -247601,8 +248437,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -247821,8 +248657,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -247918,7 +248754,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -247976,7 +248812,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -248011,7 +248851,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -248076,8 +248916,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -248109,8 +248949,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -248129,8 +248969,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -248149,8 +248989,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -248783,8 +249623,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -249003,8 +249843,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -249100,7 +249940,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -249158,7 +249998,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -249193,7 +250037,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -249258,8 +250102,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -249291,8 +250135,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -249311,8 +250155,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -249331,8 +250175,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -249965,8 +250809,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -250185,8 +251029,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -250282,7 +251126,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -250340,7 +251184,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -250375,7 +251223,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -250440,8 +251288,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -250473,8 +251321,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -250493,8 +251341,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -250513,8 +251361,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -251147,8 +251995,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -251367,8 +252215,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -251464,7 +252312,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -251522,7 +252370,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -251557,7 +252409,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -251622,8 +252474,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -251655,8 +252507,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -251675,8 +252527,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -251695,8 +252547,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -252329,8 +253181,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -252549,8 +253401,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -252646,7 +253498,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -252704,7 +253556,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -252739,7 +253595,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -252804,8 +253660,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -252837,8 +253693,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -252857,8 +253713,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -252877,8 +253733,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -253511,8 +254367,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -253731,8 +254587,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -253828,7 +254684,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -253886,7 +254742,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -253921,7 +254781,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -253986,8 +254846,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -254019,8 +254879,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -254039,8 +254899,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -254059,8 +254919,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -254693,8 +255553,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -254913,8 +255773,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -255010,7 +255870,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -255068,7 +255928,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -255103,7 +255967,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -255168,8 +256032,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -255201,8 +256065,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -255221,8 +256085,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -255241,8 +256105,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -255875,8 +256739,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -256095,8 +256959,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -256192,7 +257056,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -256250,7 +257114,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -256285,7 +257153,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -256350,8 +257218,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -256383,8 +257251,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -256403,8 +257271,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -256423,8 +257291,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -257057,8 +257925,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -257277,8 +258145,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -257374,7 +258242,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -257432,7 +258300,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -257467,7 +258339,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -257532,8 +258404,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -257565,8 +258437,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -257585,8 +258457,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -257605,8 +258477,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -258239,8 +259111,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -258459,8 +259331,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -258556,7 +259428,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -258614,7 +259486,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -258649,7 +259525,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -258714,8 +259590,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -258747,8 +259623,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -258767,8 +259643,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -258787,8 +259663,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -259421,8 +260297,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -259641,8 +260517,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -259738,7 +260614,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -259796,7 +260672,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -259831,7 +260711,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -259896,8 +260776,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -259929,8 +260809,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -259949,8 +260829,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -259969,8 +260849,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -260603,8 +261483,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -260823,8 +261703,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -260920,7 +261800,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -260978,7 +261858,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -261013,7 +261897,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -261078,8 +261962,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -261111,8 +261995,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -261131,8 +262015,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -261151,8 +262035,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -261785,8 +262669,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -262005,8 +262889,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -262102,7 +262986,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -262160,7 +263044,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -262195,7 +263083,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -262260,8 +263148,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -262293,8 +263181,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -262313,8 +263201,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -262333,8 +263221,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -262967,8 +263855,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -263187,8 +264075,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -263284,7 +264172,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -263342,7 +264230,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -263377,7 +264269,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -263442,8 +264334,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -263475,8 +264367,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -263495,8 +264387,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -263515,8 +264407,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -264149,8 +265041,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -264369,8 +265261,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -264466,7 +265358,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -264524,7 +265416,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -264559,7 +265455,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -264624,8 +265520,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -264657,8 +265553,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -264677,8 +265573,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -264697,8 +265593,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -265331,8 +266227,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -265551,8 +266447,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -265648,7 +266544,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -265706,7 +266602,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -265741,7 +266641,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -265806,8 +266706,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -265839,8 +266739,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -265859,8 +266759,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -265879,8 +266779,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -266513,8 +267413,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -266733,8 +267633,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -266830,7 +267730,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -266888,7 +267788,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -266923,7 +267827,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -266988,8 +267892,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -267021,8 +267925,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -267041,8 +267945,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -267061,8 +267965,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -267695,8 +268599,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -267915,8 +268819,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -268012,7 +268916,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -268070,7 +268974,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -268105,7 +269013,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -268170,8 +269078,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -268203,8 +269111,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -268223,8 +269131,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -268243,8 +269151,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -268877,8 +269785,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -269097,8 +270005,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -269194,7 +270102,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -269252,7 +270160,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -269287,7 +270199,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -269352,8 +270264,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -269385,8 +270297,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -269405,8 +270317,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -269425,8 +270337,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -270059,8 +270971,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -270279,8 +271191,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -270376,7 +271288,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -270434,7 +271346,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -270469,7 +271385,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -270534,8 +271450,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -270567,8 +271483,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -270587,8 +271503,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -270607,8 +271523,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -271241,8 +272157,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -271461,8 +272377,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -271558,7 +272474,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -271616,7 +272532,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -271651,7 +272571,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -271716,8 +272636,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -271749,8 +272669,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -271769,8 +272689,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -271789,8 +272709,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -272423,8 +273343,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -272643,8 +273563,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -272740,7 +273660,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -272798,7 +273718,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -272833,7 +273757,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -272898,8 +273822,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -272931,8 +273855,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -272951,8 +273875,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -272971,8 +273895,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -273605,8 +274529,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -273825,8 +274749,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -273922,7 +274846,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -273980,7 +274904,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -274015,7 +274943,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -274080,8 +275008,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -274113,8 +275041,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -274133,8 +275061,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -274153,8 +275081,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -274787,8 +275715,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -275007,8 +275935,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -275104,7 +276032,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -275162,7 +276090,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -275197,7 +276129,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -275262,8 +276194,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -275295,8 +276227,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -275315,8 +276247,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -275335,8 +276267,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -275969,8 +276901,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -276189,8 +277121,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -276286,7 +277218,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -276344,7 +277276,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -276379,7 +277315,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -276444,8 +277380,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -276477,8 +277413,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -276497,8 +277433,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -276517,8 +277453,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -277151,8 +278087,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -277371,8 +278307,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -277468,7 +278404,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -277526,7 +278462,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -277561,7 +278501,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -277626,8 +278566,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -277659,8 +278599,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -277679,8 +278619,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -277699,8 +278639,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -278333,8 +279273,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -278553,8 +279493,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -278650,7 +279590,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -278708,7 +279648,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -278743,7 +279687,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -278808,8 +279752,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -278841,8 +279785,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -278861,8 +279805,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -278881,8 +279825,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -279515,8 +280459,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -279735,8 +280679,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -279832,7 +280776,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -279890,7 +280834,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -279925,7 +280873,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -279990,8 +280938,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -280023,8 +280971,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -280043,8 +280991,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -280063,8 +281011,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -280697,8 +281645,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -280917,8 +281865,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -281014,7 +281962,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -281072,7 +282020,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -281107,7 +282059,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -281172,8 +282124,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -281205,8 +282157,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -281225,8 +282177,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -281245,8 +282197,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -281879,8 +282831,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -282099,8 +283051,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -282196,7 +283148,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -282254,7 +283206,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -282289,7 +283245,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -282354,8 +283310,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -282387,8 +283343,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -282407,8 +283363,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -282427,8 +283383,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -283061,8 +284017,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -283281,8 +284237,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -283378,7 +284334,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -283436,7 +284392,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -283471,7 +284431,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -283536,8 +284496,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -283569,8 +284529,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -283589,8 +284549,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -283609,8 +284569,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -284243,8 +285203,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -284463,8 +285423,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -284560,7 +285520,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -284618,7 +285578,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -284653,7 +285617,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -284718,8 +285682,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -284751,8 +285715,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -284771,8 +285735,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -284791,8 +285755,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -285425,8 +286389,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -285645,8 +286609,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -285742,7 +286706,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -285800,7 +286764,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -285835,7 +286803,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -285900,8 +286868,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -285933,8 +286901,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -285953,8 +286921,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -285973,8 +286941,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -286607,8 +287575,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -286827,8 +287795,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -286924,7 +287892,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -286982,7 +287950,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -287017,7 +287989,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -287082,8 +288054,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -287115,8 +288087,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -287135,8 +288107,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -287155,8 +288127,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -287789,8 +288761,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -288009,8 +288981,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -288106,7 +289078,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -288164,7 +289136,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -288199,7 +289175,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -288264,8 +289240,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -288297,8 +289273,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -288317,8 +289293,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -288337,8 +289313,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -288971,8 +289947,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -289191,8 +290167,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -289288,7 +290264,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -289346,7 +290322,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -289381,7 +290361,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -289446,8 +290426,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -289479,8 +290459,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -289499,8 +290479,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -289519,8 +290499,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -290153,8 +291133,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -290373,8 +291353,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -290470,7 +291450,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -290528,7 +291508,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -290563,7 +291547,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -290628,8 +291612,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -290661,8 +291645,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -290681,8 +291665,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -290701,8 +291685,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -291335,8 +292319,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -291555,8 +292539,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -291652,7 +292636,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -291710,7 +292694,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -291745,7 +292733,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -291810,8 +292798,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -291843,8 +292831,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -291863,8 +292851,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -291883,8 +292871,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -292517,8 +293505,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -292737,8 +293725,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -292834,7 +293822,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -292892,7 +293880,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -292927,7 +293919,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -292992,8 +293984,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -293025,8 +294017,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -293045,8 +294037,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -293065,8 +294057,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -293699,8 +294691,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -293919,8 +294911,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -294016,7 +295008,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -294074,7 +295066,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -294109,7 +295105,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -294174,8 +295170,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -294207,8 +295203,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -294227,8 +295223,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -294247,8 +295243,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -294881,8 +295877,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -295101,8 +296097,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -295198,7 +296194,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -295256,7 +296252,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -295291,7 +296291,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -295356,8 +296356,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -295389,8 +296389,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -295409,8 +296409,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -295429,8 +296429,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -296063,8 +297063,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -296283,8 +297283,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -296380,7 +297380,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -296438,7 +297438,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -296473,7 +297477,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -296538,8 +297542,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -296571,8 +297575,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -296591,8 +297595,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -296611,8 +297615,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -297245,8 +298249,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -297465,8 +298469,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -297562,7 +298566,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -297620,7 +298624,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -297655,7 +298663,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -297720,8 +298728,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -297753,8 +298761,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -297773,8 +298781,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -297793,8 +298801,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -298427,8 +299435,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -298647,8 +299655,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -298744,7 +299752,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -298802,7 +299810,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -298837,7 +299849,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -298902,8 +299914,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -298935,8 +299947,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -298955,8 +299967,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -298975,8 +299987,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -299609,8 +300621,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -299829,8 +300841,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -299926,7 +300938,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -299984,7 +300996,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -300019,7 +301035,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -300084,8 +301100,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -300117,8 +301133,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -300137,8 +301153,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -300157,8 +301173,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -300791,8 +301807,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -301011,8 +302027,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -301108,7 +302124,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -301166,7 +302182,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -301201,7 +302221,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -301266,8 +302286,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -301299,8 +302319,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -301319,8 +302339,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -301339,8 +302359,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -301973,8 +302993,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -302193,8 +303213,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -302290,7 +303310,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -302348,7 +303368,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -302383,7 +303407,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -302448,8 +303472,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -302481,8 +303505,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -302501,8 +303525,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -302521,8 +303545,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -303155,8 +304179,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -303375,8 +304399,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -303472,7 +304496,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -303530,7 +304554,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -303565,7 +304593,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -303630,8 +304658,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -303663,8 +304691,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -303683,8 +304711,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -303703,8 +304731,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -304337,8 +305365,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -304557,8 +305585,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -304654,7 +305682,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -304712,7 +305740,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -304747,7 +305779,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -304812,8 +305844,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -304845,8 +305877,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -304865,8 +305897,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -304885,8 +305917,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -305519,8 +306551,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -305739,8 +306771,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -305836,7 +306868,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -305894,7 +306926,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -305929,7 +306965,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -305994,8 +307030,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -306027,8 +307063,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -306047,8 +307083,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -306067,8 +307103,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -306701,8 +307737,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -306921,8 +307957,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -307018,7 +308054,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -307076,7 +308112,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -307111,7 +308151,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -307176,8 +308216,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -307209,8 +308249,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -307229,8 +308269,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -307249,8 +308289,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -307883,8 +308923,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -308103,8 +309143,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -308200,7 +309240,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -308258,7 +309298,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -308293,7 +309337,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -308358,8 +309402,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -308391,8 +309435,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -308411,8 +309455,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -308431,8 +309475,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -309065,8 +310109,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -309285,8 +310329,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -309382,7 +310426,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -309440,7 +310484,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -309475,7 +310523,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -309540,8 +310588,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -309573,8 +310621,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -309593,8 +310641,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -309613,8 +310661,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -310247,8 +311295,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -310467,8 +311515,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -310564,7 +311612,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -310622,7 +311670,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -310657,7 +311709,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -310722,8 +311774,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -310755,8 +311807,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -310775,8 +311827,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -310795,8 +311847,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -311429,8 +312481,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -311649,8 +312701,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -311746,7 +312798,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -311804,7 +312856,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -311839,7 +312895,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -311904,8 +312960,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -311937,8 +312993,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -311957,8 +313013,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -311977,8 +313033,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -312611,8 +313667,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -312831,8 +313887,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -312928,7 +313984,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -312986,7 +314042,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -313021,7 +314081,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -313086,8 +314146,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -313119,8 +314179,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -313139,8 +314199,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -313159,8 +314219,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -313793,8 +314853,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -314013,8 +315073,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -314110,7 +315170,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -314168,7 +315228,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -314203,7 +315267,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -314268,8 +315332,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -314301,8 +315365,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -314321,8 +315385,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -314341,8 +315405,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -314975,8 +316039,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -315195,8 +316259,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -315292,7 +316356,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -315350,7 +316414,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -315385,7 +316453,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -315450,8 +316518,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -315483,8 +316551,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -315503,8 +316571,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -315523,8 +316591,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -316157,8 +317225,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -316377,8 +317445,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -316474,7 +317542,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -316532,7 +317600,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -316567,7 +317639,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -316632,8 +317704,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -316665,8 +317737,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -316685,8 +317757,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -316705,8 +317777,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -317339,8 +318411,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -317559,8 +318631,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -317656,7 +318728,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -317714,7 +318786,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -317749,7 +318825,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -317814,8 +318890,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -317847,8 +318923,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -317867,8 +318943,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -317887,8 +318963,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -318521,8 +319597,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -318741,8 +319817,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -318838,7 +319914,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -318896,7 +319972,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -318931,7 +320011,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -318996,8 +320076,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -319029,8 +320109,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -319049,8 +320129,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -319069,8 +320149,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -319703,8 +320783,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -319923,8 +321003,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -320020,7 +321100,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -320078,7 +321158,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -320113,7 +321197,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -320178,8 +321262,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -320211,8 +321295,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -320231,8 +321315,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -320251,8 +321335,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -320885,8 +321969,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -321105,8 +322189,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -321202,7 +322286,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -321260,7 +322344,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -321295,7 +322383,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -321360,8 +322448,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -321393,8 +322481,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -321413,8 +322501,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -321433,8 +322521,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -322067,8 +323155,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -322287,8 +323375,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -322384,7 +323472,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -322442,7 +323530,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -322477,7 +323569,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -322542,8 +323634,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -322575,8 +323667,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -322595,8 +323687,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -322615,8 +323707,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -323249,8 +324341,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -323469,8 +324561,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -323566,7 +324658,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -323624,7 +324716,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -323659,7 +324755,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -323724,8 +324820,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -323757,8 +324853,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -323777,8 +324873,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -323797,8 +324893,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -324431,8 +325527,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -324651,8 +325747,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -324748,7 +325844,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -324806,7 +325902,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -324841,7 +325941,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -324906,8 +326006,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -324939,8 +326039,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -324959,8 +326059,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -324979,8 +326079,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -325613,8 +326713,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -325833,8 +326933,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -325930,7 +327030,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -325988,7 +327088,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -326023,7 +327127,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -326088,8 +327192,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -326121,8 +327225,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -326141,8 +327245,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -326161,8 +327265,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -326795,8 +327899,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -327015,8 +328119,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -327112,7 +328216,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -327170,7 +328274,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -327205,7 +328313,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -327270,8 +328378,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -327303,8 +328411,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -327323,8 +328431,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -327343,8 +328451,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -327977,8 +329085,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -328197,8 +329305,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -328294,7 +329402,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -328352,7 +329460,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -328387,7 +329499,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -328452,8 +329564,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -328485,8 +329597,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -328505,8 +329617,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -328525,8 +329637,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -329159,8 +330271,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -329379,8 +330491,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -329476,7 +330588,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -329534,7 +330646,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -329569,7 +330685,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -329634,8 +330750,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -329667,8 +330783,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -329687,8 +330803,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -329707,8 +330823,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -330341,8 +331457,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -330561,8 +331677,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -330658,7 +331774,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -330716,7 +331832,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -330751,7 +331871,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -330816,8 +331936,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -330849,8 +331969,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -330869,8 +331989,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -330889,8 +332009,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -331523,8 +332643,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -331743,8 +332863,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -331840,7 +332960,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -331898,7 +333018,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -331933,7 +333057,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -331998,8 +333122,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -332031,8 +333155,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -332051,8 +333175,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -332071,8 +333195,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -332705,8 +333829,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -332925,8 +334049,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -333022,7 +334146,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -333080,7 +334204,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -333115,7 +334243,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -333180,8 +334308,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -333213,8 +334341,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -333233,8 +334361,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -333253,8 +334381,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -333887,8 +335015,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -334107,8 +335235,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -334204,7 +335332,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -334262,7 +335390,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -334297,7 +335429,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -334362,8 +335494,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -334395,8 +335527,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -334415,8 +335547,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -334435,8 +335567,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -335069,8 +336201,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -335289,8 +336421,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -335386,7 +336518,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -335444,7 +336576,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -335479,7 +336615,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -335544,8 +336680,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -335577,8 +336713,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -335597,8 +336733,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -335617,8 +336753,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -336251,8 +337387,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -336471,8 +337607,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -336568,7 +337704,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -336626,7 +337762,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -336661,7 +337801,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -336726,8 +337866,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -336759,8 +337899,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -336779,8 +337919,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -336799,8 +337939,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -337433,8 +338573,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -337653,8 +338793,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -337750,7 +338890,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -337808,7 +338948,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -337843,7 +338987,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -337908,8 +339052,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -337941,8 +339085,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -337961,8 +339105,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -337981,8 +339125,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -338615,8 +339759,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -338835,8 +339979,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -338932,7 +340076,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -338990,7 +340134,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -339025,7 +340173,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -339090,8 +340238,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -339123,8 +340271,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -339143,8 +340291,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -339163,8 +340311,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -339797,8 +340945,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -340017,8 +341165,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -340114,7 +341262,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -340172,7 +341320,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -340207,7 +341359,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -340272,8 +341424,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -340305,8 +341457,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -340325,8 +341477,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -340345,8 +341497,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -340979,8 +342131,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -341199,8 +342351,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -341296,7 +342448,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -341354,7 +342506,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -341389,7 +342545,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -341454,8 +342610,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -341487,8 +342643,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -341507,8 +342663,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -341527,8 +342683,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -342161,8 +343317,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -342381,8 +343537,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -342478,7 +343634,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -342536,7 +343692,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -342571,7 +343731,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -342636,8 +343796,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -342669,8 +343829,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -342689,8 +343849,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -342709,8 +343869,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -343343,8 +344503,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -343563,8 +344723,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -343660,7 +344820,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -343718,7 +344878,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -343753,7 +344917,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -343818,8 +344982,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -343851,8 +345015,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -343871,8 +345035,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -343891,8 +345055,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -344525,8 +345689,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -344745,8 +345909,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -344842,7 +346006,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -344900,7 +346064,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -344935,7 +346103,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -345000,8 +346168,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -345033,8 +346201,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -345053,8 +346221,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -345073,8 +346241,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -345707,8 +346875,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -345927,8 +347095,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -346024,7 +347192,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -346082,7 +347250,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -346117,7 +347289,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -346182,8 +347354,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -346215,8 +347387,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -346235,8 +347407,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -346255,8 +347427,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -346889,8 +348061,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -347109,8 +348281,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -347206,7 +348378,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -347264,7 +348436,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -347299,7 +348475,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -347364,8 +348540,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -347397,8 +348573,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -347417,8 +348593,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -347437,8 +348613,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -348071,8 +349247,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -348291,8 +349467,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -348388,7 +349564,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -348446,7 +349622,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -348481,7 +349661,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -348546,8 +349726,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -348579,8 +349759,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -348599,8 +349779,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -348619,8 +349799,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -349253,8 +350433,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -349473,8 +350653,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -349570,7 +350750,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -349628,7 +350808,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -349663,7 +350847,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -349728,8 +350912,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -349761,8 +350945,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -349781,8 +350965,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -349801,8 +350985,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -350435,8 +351619,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -350655,8 +351839,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -350752,7 +351936,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -350810,7 +351994,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -350845,7 +352033,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -350910,8 +352098,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -350943,8 +352131,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -350963,8 +352151,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -350983,8 +352171,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -351617,8 +352805,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -351837,8 +353025,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -351934,7 +353122,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -351992,7 +353180,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -352027,7 +353219,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -352092,8 +353284,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -352125,8 +353317,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -352145,8 +353337,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -352165,8 +353357,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -352799,8 +353991,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -353019,8 +354211,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -353116,7 +354308,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -353174,7 +354366,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -353209,7 +354405,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -353274,8 +354470,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -353307,8 +354503,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -353327,8 +354523,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -353347,8 +354543,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -353981,8 +355177,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -354201,8 +355397,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -354298,7 +355494,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -354356,7 +355552,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -354391,7 +355591,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -354456,8 +355656,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -354489,8 +355689,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -354509,8 +355709,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -354529,8 +355729,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -355163,8 +356363,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -355383,8 +356583,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -355480,7 +356680,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -355538,7 +356738,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -355573,7 +356777,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -355638,8 +356842,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -355671,8 +356875,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -355691,8 +356895,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -355711,8 +356915,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -356345,8 +357549,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -356565,8 +357769,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -356662,7 +357866,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -356720,7 +357924,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -356755,7 +357963,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -356820,8 +358028,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -356853,8 +358061,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -356873,8 +358081,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -356893,8 +358101,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -357527,8 +358735,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -357747,8 +358955,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -357844,7 +359052,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -357902,7 +359110,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -357937,7 +359149,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -358002,8 +359214,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -358035,8 +359247,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -358055,8 +359267,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -358075,8 +359287,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -358709,8 +359921,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -358929,8 +360141,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -359026,7 +360238,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -359084,7 +360296,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -359119,7 +360335,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -359184,8 +360400,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -359217,8 +360433,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -359237,8 +360453,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -359257,8 +360473,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -359891,8 +361107,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -360111,8 +361327,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -360208,7 +361424,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -360266,7 +361482,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -360301,7 +361521,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -360366,8 +361586,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -360399,8 +361619,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -360419,8 +361639,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -360439,8 +361659,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -361073,8 +362293,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -361293,8 +362513,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -361390,7 +362610,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -361448,7 +362668,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -361483,7 +362707,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -361548,8 +362772,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -361581,8 +362805,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -361601,8 +362825,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -361621,8 +362845,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -362255,8 +363479,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -362475,8 +363699,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -362572,7 +363796,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -362630,7 +363854,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -362665,7 +363893,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -362730,8 +363958,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -362763,8 +363991,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -362783,8 +364011,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -362803,8 +364031,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -363437,8 +364665,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -363657,8 +364885,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -363754,7 +364982,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -363812,7 +365040,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -363847,7 +365079,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -363912,8 +365144,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -363945,8 +365177,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -363965,8 +365197,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -363985,8 +365217,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -364619,8 +365851,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -364839,8 +366071,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -364936,7 +366168,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -364994,7 +366226,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -365029,7 +366265,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -365094,8 +366330,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -365127,8 +366363,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -365147,8 +366383,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -365167,8 +366403,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -365801,8 +367037,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -366021,8 +367257,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -366118,7 +367354,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -366176,7 +367412,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -366211,7 +367451,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -366276,8 +367516,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -366309,8 +367549,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -366329,8 +367569,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -366349,8 +367589,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -366983,8 +368223,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -367203,8 +368443,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -367300,7 +368540,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -367358,7 +368598,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -367393,7 +368637,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -367458,8 +368702,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -367491,8 +368735,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -367511,8 +368755,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -367531,8 +368775,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -368165,8 +369409,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -368385,8 +369629,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -368482,7 +369726,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -368540,7 +369784,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -368575,7 +369823,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -368640,8 +369888,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -368673,8 +369921,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -368693,8 +369941,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -368713,8 +369961,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -369347,8 +370595,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -369567,8 +370815,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -369664,7 +370912,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -369722,7 +370970,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -369757,7 +371009,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -369822,8 +371074,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -369855,8 +371107,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -369875,8 +371127,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -369895,8 +371147,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -370529,8 +371781,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -370749,8 +372001,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -370846,7 +372098,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -370904,7 +372156,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -370939,7 +372195,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -371004,8 +372260,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -371037,8 +372293,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -371057,8 +372313,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -371077,8 +372333,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -371711,8 +372967,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -371931,8 +373187,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -372028,7 +373284,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -372086,7 +373342,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -372121,7 +373381,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -372186,8 +373446,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -372219,8 +373479,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -372239,8 +373499,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -372259,8 +373519,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -372893,8 +374153,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -373113,8 +374373,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -373210,7 +374470,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -373268,7 +374528,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -373303,7 +374567,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -373368,8 +374632,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -373401,8 +374665,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -373421,8 +374685,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -373441,8 +374705,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -374075,8 +375339,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -374295,8 +375559,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -374392,7 +375656,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -374450,7 +375714,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -374485,7 +375753,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -374550,8 +375818,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -374583,8 +375851,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -374603,8 +375871,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -374623,8 +375891,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -375257,8 +376525,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -375477,8 +376745,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -375574,7 +376842,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -375632,7 +376900,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -375667,7 +376939,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -375732,8 +377004,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -375765,8 +377037,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -375785,8 +377057,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -375805,8 +377077,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -376439,8 +377711,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -376659,8 +377931,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -376756,7 +378028,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -376814,7 +378086,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -376849,7 +378125,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -376914,8 +378190,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -376947,8 +378223,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -376967,8 +378243,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -376987,8 +378263,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -377621,8 +378897,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -377841,8 +379117,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -377938,7 +379214,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -377996,7 +379272,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -378031,7 +379311,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -378096,8 +379376,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -378129,8 +379409,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -378149,8 +379429,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -378169,8 +379449,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -378803,8 +380083,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -379023,8 +380303,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -379120,7 +380400,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -379178,7 +380458,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -379213,7 +380497,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -379278,8 +380562,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -379311,8 +380595,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -379331,8 +380615,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -379351,8 +380635,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -379985,8 +381269,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -380205,8 +381489,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -380302,7 +381586,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -380360,7 +381644,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -380395,7 +381683,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -380460,8 +381748,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -380493,8 +381781,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -380513,8 +381801,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -380533,8 +381821,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -381167,8 +382455,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -381387,8 +382675,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -381484,7 +382772,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -381542,7 +382830,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -381577,7 +382869,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -381642,8 +382934,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -381675,8 +382967,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -381695,8 +382987,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -381715,8 +383007,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -382349,8 +383641,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -382569,8 +383861,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -382666,7 +383958,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -382724,7 +384016,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -382759,7 +384055,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -382824,8 +384120,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -382857,8 +384153,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -382877,8 +384173,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -382897,8 +384193,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -383531,8 +384827,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -383751,8 +385047,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -383848,7 +385144,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -383906,7 +385202,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -383941,7 +385241,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -384006,8 +385306,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -384039,8 +385339,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -384059,8 +385359,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -384079,8 +385379,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -384713,8 +386013,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -384933,8 +386233,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -385030,7 +386330,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -385088,7 +386388,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -385123,7 +386427,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -385188,8 +386492,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -385221,8 +386525,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -385241,8 +386545,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -385261,8 +386565,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -385895,8 +387199,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -386115,8 +387419,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -386212,7 +387516,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -386270,7 +387574,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -386305,7 +387613,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -386370,8 +387678,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -386403,8 +387711,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -386423,8 +387731,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -386443,8 +387751,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -387077,8 +388385,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -387297,8 +388605,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -387394,7 +388702,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -387452,7 +388760,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -387487,7 +388799,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -387552,8 +388864,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -387585,8 +388897,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -387605,8 +388917,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -387625,8 +388937,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -388259,8 +389571,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -388479,8 +389791,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -388576,7 +389888,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -388634,7 +389946,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -388669,7 +389985,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -388734,8 +390050,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -388767,8 +390083,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -388787,8 +390103,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -388807,8 +390123,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -389441,8 +390757,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -389661,8 +390977,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -389758,7 +391074,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -389816,7 +391132,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -389851,7 +391171,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -389916,8 +391236,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -389949,8 +391269,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -389969,8 +391289,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -389989,8 +391309,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -390623,8 +391943,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -390843,8 +392163,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -390940,7 +392260,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -390998,7 +392318,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -391033,7 +392357,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -391098,8 +392422,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -391131,8 +392455,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -391151,8 +392475,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -391171,8 +392495,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -391805,8 +393129,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -392025,8 +393349,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -392122,7 +393446,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -392180,7 +393504,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -392215,7 +393543,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -392280,8 +393608,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -392313,8 +393641,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -392333,8 +393661,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -392353,8 +393681,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -392987,8 +394315,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -393207,8 +394535,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -393304,7 +394632,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -393362,7 +394690,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -393397,7 +394729,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -393462,8 +394794,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -393495,8 +394827,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -393515,8 +394847,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -393535,8 +394867,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -394169,8 +395501,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -394389,8 +395721,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -394486,7 +395818,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -394544,7 +395876,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -394579,7 +395915,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -394644,8 +395980,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -394677,8 +396013,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -394697,8 +396033,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -394717,8 +396053,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -395351,8 +396687,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -395571,8 +396907,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -395668,7 +397004,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -395726,7 +397062,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -395761,7 +397101,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -395826,8 +397166,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -395859,8 +397199,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -395879,8 +397219,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -395899,8 +397239,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -396533,8 +397873,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -396753,8 +398093,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -396850,7 +398190,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -396908,7 +398248,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -396943,7 +398287,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -397008,8 +398352,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -397041,8 +398385,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -397061,8 +398405,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -397081,8 +398425,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -397715,8 +399059,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -397935,8 +399279,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -398032,7 +399376,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -398090,7 +399434,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -398125,7 +399473,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -398190,8 +399538,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -398223,8 +399571,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -398243,8 +399591,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -398263,8 +399611,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -398897,8 +400245,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -399117,8 +400465,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -399214,7 +400562,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -399272,7 +400620,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -399307,7 +400659,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -399372,8 +400724,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -399405,8 +400757,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -399425,8 +400777,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -399445,8 +400797,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -400079,8 +401431,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -400299,8 +401651,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -400396,7 +401748,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -400454,7 +401806,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -400489,7 +401845,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -400554,8 +401910,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -400587,8 +401943,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -400607,8 +401963,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -400627,8 +401983,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -401261,8 +402617,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -401481,8 +402837,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -401578,7 +402934,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -401636,7 +402992,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -401671,7 +403031,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -401736,8 +403096,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -401769,8 +403129,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -401789,8 +403149,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -401809,8 +403169,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -402443,8 +403803,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -402663,8 +404023,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -402760,7 +404120,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -402818,7 +404178,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -402853,7 +404217,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -402918,8 +404282,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -402951,8 +404315,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -402971,8 +404335,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -402991,8 +404355,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -403625,8 +404989,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -403845,8 +405209,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -403942,7 +405306,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -404000,7 +405364,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -404035,7 +405403,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -404100,8 +405468,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -404133,8 +405501,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -404153,8 +405521,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -404173,8 +405541,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -404807,8 +406175,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -405027,8 +406395,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -405124,7 +406492,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -405182,7 +406550,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -405217,7 +406589,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -405282,8 +406654,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -405315,8 +406687,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -405335,8 +406707,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -405355,8 +406727,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -405989,8 +407361,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -406209,8 +407581,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -406306,7 +407678,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -406364,7 +407736,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -406399,7 +407775,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -406464,8 +407840,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -406497,8 +407873,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -406517,8 +407893,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -406537,8 +407913,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -407171,8 +408547,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -407391,8 +408767,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -407488,7 +408864,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -407546,7 +408922,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -407581,7 +408961,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -407646,8 +409026,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -407679,8 +409059,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -407699,8 +409079,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -407719,8 +409099,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -408353,8 +409733,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -408573,8 +409953,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -408670,7 +410050,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -408728,7 +410108,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -408763,7 +410147,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -408828,8 +410212,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -408861,8 +410245,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -408881,8 +410265,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -408901,8 +410285,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -409535,8 +410919,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -409755,8 +411139,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -409852,7 +411236,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -409910,7 +411294,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -409945,7 +411333,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -410010,8 +411398,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -410043,8 +411431,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -410063,8 +411451,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -410083,8 +411471,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -410717,8 +412105,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -410937,8 +412325,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -411034,7 +412422,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -411092,7 +412480,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -411127,7 +412519,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -411192,8 +412584,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -411225,8 +412617,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -411245,8 +412637,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -411265,8 +412657,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -411899,8 +413291,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -412119,8 +413511,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -412216,7 +413608,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -412274,7 +413666,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -412309,7 +413705,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -412374,8 +413770,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -412407,8 +413803,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -412427,8 +413823,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -412447,8 +413843,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -413081,8 +414477,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -413301,8 +414697,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -413398,7 +414794,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -413456,7 +414852,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -413491,7 +414891,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -413556,8 +414956,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -413589,8 +414989,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -413609,8 +415009,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -413629,8 +415029,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -414263,8 +415663,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -414483,8 +415883,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -414580,7 +415980,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -414638,7 +416038,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -414673,7 +416077,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -414738,8 +416142,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -414771,8 +416175,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -414791,8 +416195,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -414811,8 +416215,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -415445,8 +416849,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -415665,8 +417069,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -415762,7 +417166,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -415820,7 +417224,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -415855,7 +417263,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -415920,8 +417328,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -415953,8 +417361,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -415973,8 +417381,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -415993,8 +417401,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", diff --git a/docs/mitre-map/detections.csv b/docs/mitre-map/detections.csv index 72f63344b4..1a4b3c7e77 100644 --- a/docs/mitre-map/detections.csv +++ b/docs/mitre-map/detections.csv @@ -7743,710 +7743,1062 @@ T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,38 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,38 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,38 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 T1060,No,-,40 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,39 T1060,No,-,40 @@ -52812,9 +53164,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -52829,9 +53192,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -52846,9 +53220,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -52863,9 +53248,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -52880,9 +53276,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -52897,9 +53304,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -52914,9 +53332,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -52931,9 +53360,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -52948,9 +53388,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -52965,9 +53416,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -52982,9 +53444,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -52999,9 +53472,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -53016,9 +53500,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -53033,9 +53528,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -53050,9 +53556,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -53067,9 +53584,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -53084,9 +53612,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -53101,9 +53640,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -53118,9 +53668,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -53135,9 +53696,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -53152,9 +53724,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -53169,9 +53752,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -53186,9 +53780,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -53203,9 +53808,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -53220,9 +53836,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -53237,9 +53864,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -53254,9 +53892,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -53271,9 +53920,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -53288,9 +53948,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -53305,9 +53976,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -53322,9 +54004,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -53339,9 +54032,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -53356,9 +54060,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -53373,9 +54088,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -53390,9 +54116,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -53407,9 +54144,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -53424,9 +54172,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -53441,9 +54200,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -53458,9 +54228,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -53475,9 +54256,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -53492,9 +54284,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -53509,9 +54312,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -53526,9 +54340,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -53543,9 +54368,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -53560,9 +54396,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -53577,9 +54424,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -53594,9 +54452,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -53611,9 +54480,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -53628,9 +54508,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -53645,9 +54536,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -53662,9 +54564,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -53679,9 +54592,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -53696,9 +54620,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -53713,9 +54648,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -53730,9 +54676,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -53747,9 +54704,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -53764,9 +54732,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -53781,9 +54760,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -53798,9 +54788,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -53815,9 +54816,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -53832,9 +54844,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -53849,9 +54872,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -53866,9 +54900,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -53883,9 +54928,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -53900,9 +54956,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -53917,9 +54984,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -53934,9 +55012,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -53951,9 +55040,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -53968,9 +55068,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -53985,9 +55096,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -54002,9 +55124,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -54019,9 +55152,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -54036,9 +55180,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -54053,9 +55208,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -54070,9 +55236,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -54087,9 +55264,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -54104,9 +55292,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -54121,9 +55320,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -54138,9 +55348,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -54155,9 +55376,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -54172,9 +55404,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -54189,9 +55432,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -54206,9 +55460,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -54223,9 +55488,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -54240,9 +55516,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -54257,9 +55544,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -54274,9 +55572,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -54291,9 +55600,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -54308,9 +55628,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -54325,9 +55656,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -54342,9 +55684,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -54359,9 +55712,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -54376,9 +55740,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -54393,9 +55768,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -54410,9 +55796,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -54427,9 +55824,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -54444,9 +55852,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -54461,9 +55880,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -54478,9 +55908,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -54495,9 +55936,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -54512,9 +55964,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -54529,9 +55992,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -54546,9 +56020,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -54563,9 +56048,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -54580,9 +56076,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -54597,9 +56104,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -54614,9 +56132,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -54631,9 +56160,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -54648,9 +56188,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -54665,9 +56216,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -54682,9 +56244,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -54699,9 +56272,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -54716,9 +56300,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -54733,9 +56328,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -54750,9 +56356,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -54767,9 +56384,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -54784,9 +56412,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -54801,9 +56440,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -54818,9 +56468,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -54835,9 +56496,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -54852,9 +56524,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -54869,9 +56552,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -54886,9 +56580,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -54903,9 +56608,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -54920,9 +56636,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -54937,9 +56664,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -54954,9 +56692,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -54971,9 +56720,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -54988,9 +56748,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -55005,9 +56776,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -55022,9 +56804,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -55039,9 +56832,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -55056,9 +56860,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -55073,9 +56888,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -55090,9 +56916,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -55107,9 +56944,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -55124,9 +56972,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -55141,9 +57000,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -55158,9 +57028,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -55175,9 +57056,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -55192,9 +57084,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -55209,9 +57112,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -55226,9 +57140,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -55243,9 +57168,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -55260,9 +57196,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -55277,9 +57224,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -55294,9 +57252,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -55311,9 +57280,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -55328,9 +57308,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -55345,9 +57336,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -55362,9 +57364,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -55379,9 +57392,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -55396,9 +57420,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -55413,9 +57448,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -55430,9 +57476,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -55447,9 +57504,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -55464,9 +57532,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -55481,9 +57560,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -55498,9 +57588,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -55515,9 +57616,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -55532,9 +57644,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -55549,9 +57672,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -55566,9 +57700,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -55583,9 +57728,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -55600,9 +57756,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -55617,9 +57784,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -55634,9 +57812,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -55651,9 +57840,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -55668,9 +57868,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -55685,9 +57896,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -55702,9 +57924,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -55719,9 +57952,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -55736,9 +57980,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -55753,9 +58008,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -55770,9 +58036,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -55787,9 +58064,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -55804,9 +58092,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -55821,9 +58120,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -55838,9 +58148,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -55855,9 +58176,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -55872,9 +58204,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -55889,9 +58232,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -55906,9 +58260,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -55923,9 +58288,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -55940,9 +58316,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -55957,9 +58344,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -55974,9 +58372,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -55991,9 +58400,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -56008,9 +58428,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -56025,9 +58456,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -56042,9 +58484,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -56059,9 +58512,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -56076,9 +58540,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -56093,9 +58568,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -56110,9 +58596,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -56127,9 +58624,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -56144,9 +58652,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -56161,9 +58680,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -56178,9 +58708,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -56195,9 +58736,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -56212,9 +58764,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -56229,9 +58792,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -56246,9 +58820,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -56263,9 +58848,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -56280,9 +58876,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -56297,9 +58904,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -56314,9 +58932,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -56331,9 +58960,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -56348,9 +58988,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -56365,9 +59016,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -56382,9 +59044,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -56399,9 +59072,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -56416,9 +59100,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -56433,9 +59128,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -56450,9 +59156,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -56467,9 +59184,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -56484,9 +59212,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -56501,9 +59240,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -56518,9 +59268,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -56535,9 +59296,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -56552,9 +59324,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -56569,9 +59352,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -56586,9 +59380,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -56603,9 +59408,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -56620,9 +59436,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -56637,9 +59464,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -56654,9 +59492,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -56671,9 +59520,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -56688,9 +59548,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -56705,9 +59576,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -56722,9 +59604,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -56739,9 +59632,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -56756,9 +59660,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -56773,9 +59688,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -56790,9 +59716,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -56807,9 +59744,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -56824,9 +59772,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -56841,9 +59800,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -56858,9 +59828,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -56875,9 +59856,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -56892,9 +59884,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -56909,9 +59912,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -56926,9 +59940,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -56943,9 +59968,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -56960,9 +59996,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -56977,9 +60024,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -56994,9 +60052,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -57011,9 +60080,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -57028,9 +60108,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -57045,9 +60136,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -57062,9 +60164,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -57079,9 +60192,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -57096,9 +60220,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -57113,9 +60248,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -57130,9 +60276,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -57147,9 +60304,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -57164,9 +60332,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -57181,9 +60360,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -57198,9 +60388,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -57215,9 +60416,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -57232,9 +60444,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -57249,9 +60472,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -57266,9 +60500,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -57283,9 +60528,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -57300,9 +60556,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -57317,9 +60584,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -57334,9 +60612,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -57351,9 +60640,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -57368,9 +60668,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -57385,9 +60696,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -57402,9 +60724,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -57419,9 +60752,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -57436,9 +60780,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -57453,9 +60808,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -57470,9 +60836,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -57487,9 +60864,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -57504,9 +60892,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -57521,9 +60920,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -57538,9 +60948,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -57555,9 +60976,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -57572,9 +61004,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -57589,9 +61032,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -57606,9 +61060,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -57623,9 +61088,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -57640,9 +61116,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -57657,9 +61144,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -57674,9 +61172,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -57691,9 +61200,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -57708,9 +61228,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -57725,9 +61256,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -57742,9 +61284,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -57759,9 +61312,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -57776,9 +61340,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -57793,9 +61368,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -57810,9 +61396,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -57827,9 +61424,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -57844,9 +61452,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -57861,9 +61480,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -57878,9 +61508,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -57895,9 +61536,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -57912,9 +61564,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -57929,9 +61592,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -57946,9 +61620,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -57963,9 +61648,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -57980,9 +61676,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -57997,9 +61704,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -58014,9 +61732,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -58031,9 +61760,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -58048,9 +61788,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -58065,9 +61816,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -58082,9 +61844,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -58099,9 +61872,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -58116,9 +61900,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -58133,9 +61928,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -58150,9 +61956,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -58167,9 +61984,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -58184,9 +62012,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -58201,9 +62040,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -58218,9 +62068,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -58235,9 +62096,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -58252,9 +62124,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -58269,9 +62152,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -58286,9 +62180,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -58303,9 +62208,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -58320,9 +62236,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -58337,9 +62264,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -58354,9 +62292,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -58371,9 +62320,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -58388,9 +62348,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -58405,9 +62376,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -58422,9 +62404,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -58439,9 +62432,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -58456,9 +62460,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -58473,9 +62488,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -58490,9 +62516,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -58507,9 +62544,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -58524,9 +62572,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -58541,9 +62600,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -58558,9 +62628,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -58575,9 +62656,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -58592,9 +62684,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -58609,9 +62712,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -58626,9 +62740,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -58643,9 +62768,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -58660,9 +62796,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -58677,9 +62824,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -58694,9 +62852,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -58711,9 +62880,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -58728,9 +62908,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -58745,9 +62936,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -58762,9 +62964,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -58779,9 +62992,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1571,No,-,11 T1073,No,-,11 @@ -61267,7 +65491,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -61289,7 +65514,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -61311,7 +65537,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -61333,7 +65560,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -61355,7 +65583,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -61377,7 +65606,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -61399,7 +65629,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -61421,7 +65652,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -61443,7 +65675,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -61465,7 +65698,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -61487,7 +65721,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -61509,7 +65744,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -61531,7 +65767,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -61553,7 +65790,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -61575,7 +65813,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -61597,7 +65836,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -61619,7 +65859,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -61641,7 +65882,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -61663,7 +65905,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -61685,7 +65928,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -61707,7 +65951,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -61729,7 +65974,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -61751,7 +65997,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -61773,7 +66020,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -61795,7 +66043,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -61817,7 +66066,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -61839,7 +66089,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -61861,7 +66112,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -61883,7 +66135,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -61905,7 +66158,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -61927,7 +66181,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -61949,7 +66204,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -61971,7 +66227,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -61993,7 +66250,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -62015,7 +66273,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -62037,7 +66296,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -62059,7 +66319,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -62081,7 +66342,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -62103,7 +66365,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -62125,7 +66388,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -62147,7 +66411,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -62169,7 +66434,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -62191,7 +66457,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -62213,7 +66480,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -62235,7 +66503,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -62257,7 +66526,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -62279,7 +66549,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -62301,7 +66572,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -62323,7 +66595,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -62345,7 +66618,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -62367,7 +66641,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -62389,7 +66664,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -62411,7 +66687,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -62433,7 +66710,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -62455,7 +66733,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -62477,7 +66756,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -62499,7 +66779,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -62521,7 +66802,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -62543,7 +66825,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -62565,7 +66848,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -62587,7 +66871,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -62609,7 +66894,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -62631,7 +66917,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -62653,7 +66940,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -62675,7 +66963,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -62697,7 +66986,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -62719,7 +67009,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -62741,7 +67032,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -62763,7 +67055,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -62785,7 +67078,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -62807,7 +67101,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -62829,7 +67124,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -62851,7 +67147,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -62873,7 +67170,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -62895,7 +67193,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -62917,7 +67216,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -62939,7 +67239,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -62961,7 +67262,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -62983,7 +67285,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -63005,7 +67308,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -63027,7 +67331,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -63049,7 +67354,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -63071,7 +67377,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -63093,7 +67400,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -63115,7 +67423,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -63137,7 +67446,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -63159,7 +67469,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -63181,7 +67492,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -63203,7 +67515,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -63225,7 +67538,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -63247,7 +67561,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -63269,7 +67584,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -63291,7 +67607,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -63313,7 +67630,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -63335,7 +67653,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -63357,7 +67676,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -63379,7 +67699,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -63401,7 +67722,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -63423,7 +67745,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -63445,7 +67768,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -63467,7 +67791,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -63489,7 +67814,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -63511,7 +67837,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -63533,7 +67860,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -63555,7 +67883,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -63577,7 +67906,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -63599,7 +67929,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -63621,7 +67952,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -63643,7 +67975,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -63665,7 +67998,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -63687,7 +68021,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -63709,7 +68044,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -63731,7 +68067,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -63753,7 +68090,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -63775,7 +68113,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -63797,7 +68136,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -63819,7 +68159,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -63841,7 +68182,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -63863,7 +68205,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -63885,7 +68228,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -63907,7 +68251,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -63929,7 +68274,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -63951,7 +68297,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -63973,7 +68320,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -63995,7 +68343,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -64017,7 +68366,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -64039,7 +68389,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -64061,7 +68412,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -64083,7 +68435,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -64105,7 +68458,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -64127,7 +68481,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -64149,7 +68504,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -64171,7 +68527,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -64193,7 +68550,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -64215,7 +68573,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -64237,7 +68596,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -64259,7 +68619,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -64281,7 +68642,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -64303,7 +68665,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -64325,7 +68688,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -64347,7 +68711,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -64369,7 +68734,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -64391,7 +68757,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -64413,7 +68780,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -64435,7 +68803,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -64457,7 +68826,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -64479,7 +68849,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -64501,7 +68872,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -64523,7 +68895,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -64545,7 +68918,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -64567,7 +68941,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -64589,7 +68964,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -64611,7 +68987,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -64633,7 +69010,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -64655,7 +69033,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -64677,7 +69056,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -64699,7 +69079,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -64721,7 +69102,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -64743,7 +69125,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -64765,7 +69148,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -64787,7 +69171,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -64809,7 +69194,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -64831,7 +69217,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -64853,7 +69240,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -64875,7 +69263,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -64897,7 +69286,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -64919,7 +69309,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -64941,7 +69332,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -64963,7 +69355,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -64985,7 +69378,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -65007,7 +69401,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -65029,7 +69424,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -65051,7 +69447,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -65073,7 +69470,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -65095,7 +69493,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -65117,7 +69516,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -65139,7 +69539,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -65161,7 +69562,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -65183,7 +69585,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -65205,7 +69608,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -65227,7 +69631,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -65249,7 +69654,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -65271,7 +69677,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -65293,7 +69700,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -65315,7 +69723,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -65337,7 +69746,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -65359,7 +69769,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -65381,7 +69792,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -65403,7 +69815,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -65425,7 +69838,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -65447,7 +69861,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -65469,7 +69884,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -65491,7 +69907,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -65513,7 +69930,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -65535,7 +69953,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -65557,7 +69976,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -65579,7 +69999,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -65601,7 +70022,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -65623,7 +70045,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -65645,7 +70068,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -65667,7 +70091,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -65689,7 +70114,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -65711,7 +70137,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -65733,7 +70160,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -65755,7 +70183,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -65777,7 +70206,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -65799,7 +70229,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -65821,7 +70252,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -65843,7 +70275,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -65865,7 +70298,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -65887,7 +70321,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -65909,7 +70344,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -65931,7 +70367,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -65953,7 +70390,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -65975,7 +70413,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -65997,7 +70436,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -66019,7 +70459,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -66041,7 +70482,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -66063,7 +70505,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -66085,7 +70528,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -66107,7 +70551,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -66129,7 +70574,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -66151,7 +70597,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -66173,7 +70620,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -66195,7 +70643,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -66217,7 +70666,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -66239,7 +70689,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -66261,7 +70712,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -66283,7 +70735,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -66305,7 +70758,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -66327,7 +70781,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -66349,7 +70804,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -66371,7 +70827,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -66393,7 +70850,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -66415,7 +70873,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -66437,7 +70896,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -66459,7 +70919,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -66481,7 +70942,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -66503,7 +70965,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -66525,7 +70988,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -66547,7 +71011,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -66569,7 +71034,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -66591,7 +71057,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -66613,7 +71080,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -66635,7 +71103,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -66657,7 +71126,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -66679,7 +71149,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -66701,7 +71172,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -66723,7 +71195,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -66745,7 +71218,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -66767,7 +71241,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -66789,7 +71264,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -66811,7 +71287,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -66833,7 +71310,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -66855,7 +71333,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -66877,7 +71356,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -66899,7 +71379,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -66921,7 +71402,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -66943,7 +71425,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -66965,7 +71448,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -66987,7 +71471,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -67009,7 +71494,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -67031,7 +71517,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -67053,7 +71540,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -67075,7 +71563,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -67097,7 +71586,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -67119,7 +71609,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -67141,7 +71632,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -67163,7 +71655,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -67185,7 +71678,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -67207,7 +71701,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -67229,7 +71724,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -67251,7 +71747,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -67273,7 +71770,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -67295,7 +71793,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -67317,7 +71816,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -67339,7 +71839,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -67361,7 +71862,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -67383,7 +71885,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -67405,7 +71908,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -67427,7 +71931,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -67449,7 +71954,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -67471,7 +71977,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -67493,7 +72000,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -67515,7 +72023,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -67537,7 +72046,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -67559,7 +72069,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -67581,7 +72092,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -67603,7 +72115,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -67625,7 +72138,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -67647,7 +72161,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -67669,7 +72184,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -67691,7 +72207,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -67713,7 +72230,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -67735,7 +72253,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -67757,7 +72276,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -67779,7 +72299,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -67801,7 +72322,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -67823,7 +72345,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -67845,7 +72368,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -67867,7 +72391,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -67889,7 +72414,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -67911,7 +72437,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -67933,7 +72460,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -67955,7 +72483,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -67977,7 +72506,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -67999,7 +72529,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -68021,7 +72552,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -68043,7 +72575,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -68065,7 +72598,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -68087,7 +72621,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -68109,7 +72644,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -68131,7 +72667,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -68153,7 +72690,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -68175,7 +72713,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -68197,7 +72736,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -68219,7 +72759,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -68241,7 +72782,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -68263,7 +72805,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -68285,7 +72828,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -68307,7 +72851,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -68329,7 +72874,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -68351,7 +72897,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -68373,7 +72920,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -68395,7 +72943,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -68417,7 +72966,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -68439,7 +72989,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -68461,7 +73012,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -68483,7 +73035,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -68505,7 +73058,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -68527,7 +73081,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -68549,7 +73104,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -68571,7 +73127,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -68593,7 +73150,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -68615,7 +73173,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -68637,7 +73196,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -68659,7 +73219,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -68681,7 +73242,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -68703,7 +73265,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -68725,7 +73288,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -68747,7 +73311,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -68769,7 +73334,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -68791,7 +73357,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -68813,7 +73380,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -68835,7 +73403,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -68857,7 +73426,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -68879,7 +73449,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -68901,7 +73472,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -68923,7 +73495,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -68945,7 +73518,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -68967,7 +73541,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -68989,7 +73564,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1132.001,No,-,8 T1059.007,No,-,8 @@ -99287,7 +103863,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -99314,7 +103891,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -99341,7 +103919,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -99368,7 +103947,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -99395,7 +103975,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -99422,7 +104003,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -99449,7 +104031,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -99476,7 +104059,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -99503,7 +104087,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -99530,7 +104115,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -99557,7 +104143,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -99584,7 +104171,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -99611,7 +104199,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -99638,7 +104227,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -99665,7 +104255,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -99692,7 +104283,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -99719,7 +104311,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -99746,7 +104339,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -99773,7 +104367,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -99800,7 +104395,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -99827,7 +104423,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -99854,7 +104451,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -99881,7 +104479,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -99908,7 +104507,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -99935,7 +104535,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -99962,7 +104563,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -99989,7 +104591,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -100016,7 +104619,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -100043,7 +104647,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -100070,7 +104675,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -100097,7 +104703,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -100124,7 +104731,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -100151,7 +104759,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -100178,7 +104787,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -100205,7 +104815,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -100232,7 +104843,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -100259,7 +104871,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -100286,7 +104899,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -100313,7 +104927,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -100340,7 +104955,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -100367,7 +104983,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -100394,7 +105011,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -100421,7 +105039,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -100448,7 +105067,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -100475,7 +105095,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -100502,7 +105123,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -100529,7 +105151,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -100556,7 +105179,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -100583,7 +105207,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -100610,7 +105235,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -100637,7 +105263,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -100664,7 +105291,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -100691,7 +105319,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -100718,7 +105347,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -100745,7 +105375,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -100772,7 +105403,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -100799,7 +105431,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -100826,7 +105459,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -100853,7 +105487,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -100880,7 +105515,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -100907,7 +105543,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -100934,7 +105571,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -100961,7 +105599,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -100988,7 +105627,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -101015,7 +105655,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -101042,7 +105683,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -101069,7 +105711,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -101096,7 +105739,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -101123,7 +105767,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -101150,7 +105795,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -101177,7 +105823,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -101204,7 +105851,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -101231,7 +105879,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -101258,7 +105907,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -101285,7 +105935,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -101312,7 +105963,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -101339,7 +105991,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -101366,7 +106019,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -101393,7 +106047,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -101420,7 +106075,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -101447,7 +106103,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -101474,7 +106131,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -101501,7 +106159,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -101528,7 +106187,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -101555,7 +106215,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -101582,7 +106243,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -101609,7 +106271,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -101636,7 +106299,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -101663,7 +106327,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -101690,7 +106355,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -101717,7 +106383,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -101744,7 +106411,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -101771,7 +106439,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -101798,7 +106467,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -101825,7 +106495,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -101852,7 +106523,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -101879,7 +106551,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -101906,7 +106579,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -101933,7 +106607,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -101960,7 +106635,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -101987,7 +106663,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -102014,7 +106691,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -102041,7 +106719,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -102068,7 +106747,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -102095,7 +106775,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -102122,7 +106803,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -102149,7 +106831,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -102176,7 +106859,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -102203,7 +106887,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -102230,7 +106915,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -102257,7 +106943,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -102284,7 +106971,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -102311,7 +106999,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -102338,7 +107027,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -102365,7 +107055,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -102392,7 +107083,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -102419,7 +107111,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -102446,7 +107139,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -102473,7 +107167,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -102500,7 +107195,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -102527,7 +107223,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -102554,7 +107251,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -102581,7 +107279,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -102608,7 +107307,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -102635,7 +107335,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -102662,7 +107363,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -102689,7 +107391,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -102716,7 +107419,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -102743,7 +107447,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -102770,7 +107475,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -102797,7 +107503,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -102824,7 +107531,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -102851,7 +107559,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -102878,7 +107587,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -102905,7 +107615,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -102932,7 +107643,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -102959,7 +107671,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -102986,7 +107699,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -103013,7 +107727,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -103040,7 +107755,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -103067,7 +107783,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -103094,7 +107811,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -103121,7 +107839,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -103148,7 +107867,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -103175,7 +107895,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -103202,7 +107923,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -103229,7 +107951,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -103256,7 +107979,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -103283,7 +108007,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -103310,7 +108035,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -103337,7 +108063,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -103364,7 +108091,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -103391,7 +108119,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -103418,7 +108147,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -103445,7 +108175,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -103472,7 +108203,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -103499,7 +108231,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -103526,7 +108259,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -103553,7 +108287,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -103580,7 +108315,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -103607,7 +108343,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -103634,7 +108371,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -103661,7 +108399,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -103688,7 +108427,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -103715,7 +108455,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -103742,7 +108483,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -103769,7 +108511,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -103796,7 +108539,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -103823,7 +108567,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -103850,7 +108595,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -103877,7 +108623,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -103904,7 +108651,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -103931,7 +108679,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -103958,7 +108707,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -103985,7 +108735,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -104012,7 +108763,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -104039,7 +108791,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -104066,7 +108819,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -104093,7 +108847,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -104120,7 +108875,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -104147,7 +108903,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -104174,7 +108931,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -104201,7 +108959,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -104228,7 +108987,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -104255,7 +109015,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -104282,7 +109043,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -104309,7 +109071,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -104336,7 +109099,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -104363,7 +109127,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -104390,7 +109155,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -104417,7 +109183,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -104444,7 +109211,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -104471,7 +109239,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -104498,7 +109267,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -104525,7 +109295,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -104552,7 +109323,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -104579,7 +109351,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -104606,7 +109379,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -104633,7 +109407,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -104660,7 +109435,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -104687,7 +109463,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -104714,7 +109491,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -104741,7 +109519,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -104768,7 +109547,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -104795,7 +109575,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -104822,7 +109603,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -104849,7 +109631,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -104876,7 +109659,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -104903,7 +109687,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -104930,7 +109715,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -104957,7 +109743,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -104984,7 +109771,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -105011,7 +109799,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -105038,7 +109827,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -105065,7 +109855,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -105092,7 +109883,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -105119,7 +109911,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -105146,7 +109939,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -105173,7 +109967,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -105200,7 +109995,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -105227,7 +110023,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -105254,7 +110051,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -105281,7 +110079,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -105308,7 +110107,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -105335,7 +110135,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -105362,7 +110163,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -105389,7 +110191,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -105416,7 +110219,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -105443,7 +110247,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -105470,7 +110275,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -105497,7 +110303,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -105524,7 +110331,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -105551,7 +110359,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -105578,7 +110387,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -105605,7 +110415,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -105632,7 +110443,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -105659,7 +110471,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -105686,7 +110499,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -105713,7 +110527,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -105740,7 +110555,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -105767,7 +110583,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -105794,7 +110611,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -105821,7 +110639,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -105848,7 +110667,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -105875,7 +110695,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -105902,7 +110723,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -105929,7 +110751,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -105956,7 +110779,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -105983,7 +110807,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -106010,7 +110835,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -106037,7 +110863,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -106064,7 +110891,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -106091,7 +110919,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -106118,7 +110947,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -106145,7 +110975,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -106172,7 +111003,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -106199,7 +111031,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -106226,7 +111059,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -106253,7 +111087,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -106280,7 +111115,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -106307,7 +111143,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -106334,7 +111171,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -106361,7 +111199,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -106388,7 +111227,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -106415,7 +111255,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -106442,7 +111283,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -106469,7 +111311,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -106496,7 +111339,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -106523,7 +111367,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -106550,7 +111395,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -106577,7 +111423,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -106604,7 +111451,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -106631,7 +111479,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -106658,7 +111507,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -106685,7 +111535,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -106712,7 +111563,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -106739,7 +111591,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -106766,7 +111619,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -106793,7 +111647,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -106820,7 +111675,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -106847,7 +111703,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -106874,7 +111731,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -106901,7 +111759,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -106928,7 +111787,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -106955,7 +111815,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -106982,7 +111843,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -107009,7 +111871,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -107036,7 +111899,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -107063,7 +111927,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -107090,7 +111955,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -107117,7 +111983,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -107144,7 +112011,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -107171,7 +112039,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -107198,7 +112067,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -107225,7 +112095,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -107252,7 +112123,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -107279,7 +112151,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -107306,7 +112179,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -107333,7 +112207,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -107360,7 +112235,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -107387,7 +112263,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -107414,7 +112291,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -107441,7 +112319,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -107468,7 +112347,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -107495,7 +112375,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -107522,7 +112403,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -107549,7 +112431,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -107576,7 +112459,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -107603,7 +112487,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -107630,7 +112515,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -107657,7 +112543,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -107684,7 +112571,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -107711,7 +112599,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -107738,7 +112627,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -107765,7 +112655,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -107792,7 +112683,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -107819,7 +112711,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -107846,7 +112739,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -107873,7 +112767,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -107900,7 +112795,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -107927,7 +112823,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -107954,7 +112851,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -107981,7 +112879,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -108008,7 +112907,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -108035,7 +112935,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -108062,7 +112963,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -108089,7 +112991,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -108116,7 +113019,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -108143,7 +113047,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -108170,7 +113075,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -108197,7 +113103,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -108224,7 +113131,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -108251,7 +113159,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -108278,7 +113187,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -108305,7 +113215,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -108332,7 +113243,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -108359,7 +113271,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -108386,7 +113299,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -108413,7 +113327,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -108440,7 +113355,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -108467,7 +113383,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -108494,7 +113411,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -108521,7 +113439,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -108548,7 +113467,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -108575,7 +113495,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -108602,7 +113523,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -108629,7 +113551,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -108656,7 +113579,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -108683,7 +113607,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -108710,7 +113635,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -108737,7 +113663,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -108764,7 +113691,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1561.002,No,-,4 @@ -108789,8 +113717,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -108829,8 +113757,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -108869,8 +113797,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -108909,8 +113837,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -108949,8 +113877,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -108989,8 +113917,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -109029,8 +113957,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -109069,8 +113997,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -109109,8 +114037,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -109149,8 +114077,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -109189,8 +114117,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -109229,8 +114157,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -109269,8 +114197,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -109309,8 +114237,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -109349,8 +114277,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -109389,8 +114317,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -109429,8 +114357,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -109469,8 +114397,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -109509,8 +114437,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -109549,8 +114477,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -109589,8 +114517,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -109629,8 +114557,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -109669,8 +114597,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -109709,8 +114637,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -109749,8 +114677,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -109789,8 +114717,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -109829,8 +114757,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -109869,8 +114797,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -109909,8 +114837,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -109949,8 +114877,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -109989,8 +114917,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -110029,8 +114957,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -110069,8 +114997,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -110109,8 +115037,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -110149,8 +115077,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -110189,8 +115117,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -110229,8 +115157,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -110269,8 +115197,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -110309,8 +115237,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -110349,8 +115277,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -110389,8 +115317,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -110429,8 +115357,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -110469,8 +115397,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -110509,8 +115437,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -110549,8 +115477,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -110589,8 +115517,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -110629,8 +115557,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -110669,8 +115597,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -110709,8 +115637,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -110749,8 +115677,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -110789,8 +115717,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -110829,8 +115757,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -110869,8 +115797,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -110909,8 +115837,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -110949,8 +115877,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -110989,8 +115917,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -111029,8 +115957,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -111069,8 +115997,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -111109,8 +116037,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -111149,8 +116077,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -111189,8 +116117,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -111229,8 +116157,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -111269,8 +116197,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -111309,8 +116237,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -111349,8 +116277,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -111389,8 +116317,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -111429,8 +116357,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -111469,8 +116397,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -111509,8 +116437,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -111549,8 +116477,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -111589,8 +116517,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -111629,8 +116557,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -111669,8 +116597,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -111709,8 +116637,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -111749,8 +116677,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -111789,8 +116717,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -111829,8 +116757,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -111869,8 +116797,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -111909,8 +116837,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -111949,8 +116877,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -111989,8 +116917,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -112029,8 +116957,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -112069,8 +116997,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -112109,8 +117037,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -112149,8 +117077,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -112189,8 +117117,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -112229,8 +117157,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -112269,8 +117197,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -112309,8 +117237,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -112349,8 +117277,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -112389,8 +117317,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -112429,8 +117357,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -112469,8 +117397,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -112509,8 +117437,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -112549,8 +117477,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -112589,8 +117517,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -112629,8 +117557,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -112669,8 +117597,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -112709,8 +117637,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -112749,8 +117677,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -112789,8 +117717,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -112829,8 +117757,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -112869,8 +117797,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -112909,8 +117837,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -112949,8 +117877,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -112989,8 +117917,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -113029,8 +117957,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -113069,8 +117997,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -113109,8 +118037,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -113149,8 +118077,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -113189,8 +118117,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -113229,8 +118157,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -113269,8 +118197,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -113309,8 +118237,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -113349,8 +118277,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -113389,8 +118317,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -113429,8 +118357,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -113469,8 +118397,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -113509,8 +118437,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -113549,8 +118477,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -113589,8 +118517,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -113629,8 +118557,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -113669,8 +118597,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -113709,8 +118637,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -113749,8 +118677,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -113789,8 +118717,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -113829,8 +118757,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -113869,8 +118797,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -113909,8 +118837,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -113949,8 +118877,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -113989,8 +118917,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -114029,8 +118957,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -114069,8 +118997,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -114109,8 +119037,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -114149,8 +119077,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -114189,8 +119117,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -114229,8 +119157,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -114269,8 +119197,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -114309,8 +119237,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -114349,8 +119277,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -114389,8 +119317,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -114429,8 +119357,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -114469,8 +119397,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -114509,8 +119437,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -114549,8 +119477,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -114589,8 +119517,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -114629,8 +119557,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -114669,8 +119597,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -114709,8 +119637,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -114749,8 +119677,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -114789,8 +119717,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -114829,8 +119757,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -114869,8 +119797,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -114909,8 +119837,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -114949,8 +119877,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -114989,8 +119917,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -115029,8 +119957,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -115069,8 +119997,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -115109,8 +120037,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -115149,8 +120077,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -115189,8 +120117,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -115229,8 +120157,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -115269,8 +120197,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -115309,8 +120237,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -115349,8 +120277,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -115389,8 +120317,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -115429,8 +120357,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -115469,8 +120397,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -115509,8 +120437,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -115549,8 +120477,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -115589,8 +120517,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -115629,8 +120557,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -115669,8 +120597,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -115709,8 +120637,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -115749,8 +120677,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -115789,8 +120717,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -115829,8 +120757,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -115869,8 +120797,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -115909,8 +120837,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -115949,8 +120877,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -115989,8 +120917,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -116029,8 +120957,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -116069,8 +120997,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -116109,8 +121037,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -116149,8 +121077,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -116189,8 +121117,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -116229,8 +121157,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -116269,8 +121197,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -116309,8 +121237,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -116349,8 +121277,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -116389,8 +121317,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -116429,8 +121357,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -116469,8 +121397,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -116509,8 +121437,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -116549,8 +121477,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -116589,8 +121517,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -116629,8 +121557,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -116669,8 +121597,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -116709,8 +121637,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -116749,8 +121677,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -116789,8 +121717,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -116829,8 +121757,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -116869,8 +121797,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -116909,8 +121837,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -116949,8 +121877,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -116989,8 +121917,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -117029,8 +121957,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -117069,8 +121997,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -117109,8 +122037,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -117149,8 +122077,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -117189,8 +122117,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -117229,8 +122157,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -117269,8 +122197,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -117309,8 +122237,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -117349,8 +122277,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -117389,8 +122317,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -117429,8 +122357,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -117469,8 +122397,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -117509,8 +122437,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -117549,8 +122477,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -117589,8 +122517,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -117629,8 +122557,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -117669,8 +122597,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -117709,8 +122637,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -117749,8 +122677,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -117789,8 +122717,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -117829,8 +122757,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -117869,8 +122797,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -117909,8 +122837,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -117949,8 +122877,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -117989,8 +122917,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -118029,8 +122957,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -118069,8 +122997,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -118109,8 +123037,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -118149,8 +123077,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -118189,8 +123117,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -118229,8 +123157,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -118269,8 +123197,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -118309,8 +123237,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -118349,8 +123277,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -118389,8 +123317,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -118429,8 +123357,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -118469,8 +123397,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -118509,8 +123437,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -118549,8 +123477,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -118589,8 +123517,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -118629,8 +123557,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -118669,8 +123597,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -118709,8 +123637,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -118749,8 +123677,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -118789,8 +123717,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -118829,8 +123757,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -118869,8 +123797,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -118909,8 +123837,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -118949,8 +123877,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -118989,8 +123917,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -119029,8 +123957,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -119069,8 +123997,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -119109,8 +124037,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -119149,8 +124077,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -119189,8 +124117,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -119229,8 +124157,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -119269,8 +124197,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -119309,8 +124237,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -119349,8 +124277,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -119389,8 +124317,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -119429,8 +124357,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -119469,8 +124397,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -119509,8 +124437,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -119549,8 +124477,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -119589,8 +124517,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -119629,8 +124557,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -119669,8 +124597,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -119709,8 +124637,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -119749,8 +124677,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -119789,8 +124717,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -119829,8 +124757,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -119869,8 +124797,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -119909,8 +124837,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -119949,8 +124877,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -119989,8 +124917,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -120029,8 +124957,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -120069,8 +124997,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -120109,8 +125037,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -120149,8 +125077,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -120189,8 +125117,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -120229,8 +125157,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -120269,8 +125197,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -120309,8 +125237,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -120349,8 +125277,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -120389,8 +125317,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -120429,8 +125357,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -120469,8 +125397,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -120509,8 +125437,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -120549,8 +125477,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -120589,8 +125517,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -120629,8 +125557,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -120669,8 +125597,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -120709,8 +125637,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -120749,8 +125677,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -120789,8 +125717,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -120829,8 +125757,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -120869,8 +125797,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -120909,8 +125837,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -120949,8 +125877,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -120989,8 +125917,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -121029,8 +125957,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -121069,8 +125997,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -121109,8 +126037,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -121149,8 +126077,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -121189,8 +126117,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -121229,8 +126157,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -121269,8 +126197,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -121309,8 +126237,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -121349,8 +126277,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -121389,8 +126317,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -121429,8 +126357,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -121469,8 +126397,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -121509,8 +126437,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -121549,8 +126477,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -121589,8 +126517,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -121629,8 +126557,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -121669,8 +126597,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -121709,8 +126637,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -121749,8 +126677,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -121789,8 +126717,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -121829,8 +126757,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -121869,8 +126797,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -121909,8 +126837,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -121949,8 +126877,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -121989,8 +126917,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -122029,8 +126957,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -122069,8 +126997,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -122109,8 +127037,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -122149,8 +127077,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -122189,8 +127117,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -122229,8 +127157,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -122269,8 +127197,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -122309,8 +127237,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -122349,8 +127277,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -122389,8 +127317,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -122429,8 +127357,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -122469,8 +127397,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -122509,8 +127437,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -122549,8 +127477,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -122589,8 +127517,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -122629,8 +127557,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -122669,8 +127597,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -122709,8 +127637,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -122749,8 +127677,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -122789,8 +127717,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -122829,8 +127757,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -122879,7 +127807,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -122924,7 +127854,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -122969,7 +127901,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -123014,7 +127948,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -123059,7 +127995,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -123104,7 +128042,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -123149,7 +128089,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -123194,7 +128136,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -123239,7 +128183,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -123284,7 +128230,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -123329,7 +128277,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -123374,7 +128324,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -123419,7 +128371,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -123464,7 +128418,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -123509,7 +128465,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -123554,7 +128512,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -123599,7 +128559,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -123644,7 +128606,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -123689,7 +128653,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -123734,7 +128700,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -123779,7 +128747,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -123824,7 +128794,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -123869,7 +128841,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -123914,7 +128888,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -123959,7 +128935,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -124004,7 +128982,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -124049,7 +129029,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -124094,7 +129076,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -124139,7 +129123,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -124184,7 +129170,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -124229,7 +129217,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -124274,7 +129264,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -124319,7 +129311,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -124364,7 +129358,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -124409,7 +129405,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -124454,7 +129452,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -124499,7 +129499,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -124544,7 +129546,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -124589,7 +129593,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -124634,7 +129640,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -124679,7 +129687,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -124724,7 +129734,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -124769,7 +129781,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -124814,7 +129828,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -124859,7 +129875,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -124904,7 +129922,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -124949,7 +129969,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -124994,7 +130016,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -125039,7 +130063,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -125084,7 +130110,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -125129,7 +130157,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -125174,7 +130204,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -125219,7 +130251,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -125264,7 +130298,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -125309,7 +130345,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -125354,7 +130392,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -125399,7 +130439,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -125444,7 +130486,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -125489,7 +130533,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -125534,7 +130580,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -125579,7 +130627,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -125624,7 +130674,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -125669,7 +130721,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -125714,7 +130768,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -125759,7 +130815,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -125804,7 +130862,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -125849,7 +130909,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -125894,7 +130956,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -125939,7 +131003,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -125984,7 +131050,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -126029,7 +131097,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -126074,7 +131144,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -126119,7 +131191,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -126164,7 +131238,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -126209,7 +131285,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -126254,7 +131332,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -126299,7 +131379,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -126344,7 +131426,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -126389,7 +131473,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -126434,7 +131520,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -126479,7 +131567,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -126524,7 +131614,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -126569,7 +131661,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -126614,7 +131708,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -126659,7 +131755,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -126704,7 +131802,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -126749,7 +131849,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -126794,7 +131896,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -126839,7 +131943,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -126884,7 +131990,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -126929,7 +132037,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -126974,7 +132084,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -127019,7 +132131,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -127064,7 +132178,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -127109,7 +132225,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -127154,7 +132272,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -127199,7 +132319,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -127244,7 +132366,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -127289,7 +132413,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -127334,7 +132460,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -127379,7 +132507,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -127424,7 +132554,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -127469,7 +132601,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -127514,7 +132648,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -127559,7 +132695,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -127604,7 +132742,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -127649,7 +132789,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -127694,7 +132836,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -127739,7 +132883,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -127784,7 +132930,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -127829,7 +132977,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -127874,7 +133024,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -127919,7 +133071,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -127964,7 +133118,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -128009,7 +133165,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -128054,7 +133212,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -128099,7 +133259,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -128144,7 +133306,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -128189,7 +133353,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -128234,7 +133400,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -128279,7 +133447,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -128324,7 +133494,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -128369,7 +133541,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -128414,7 +133588,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -128459,7 +133635,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -128504,7 +133682,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -128549,7 +133729,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -128594,7 +133776,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -128639,7 +133823,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -128684,7 +133870,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -128729,7 +133917,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -128774,7 +133964,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -128819,7 +134011,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -128864,7 +134058,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -128909,7 +134105,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -128954,7 +134152,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -128999,7 +134199,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -129044,7 +134246,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -129089,7 +134293,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -129134,7 +134340,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -129179,7 +134387,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -129224,7 +134434,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -129269,7 +134481,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -129314,7 +134528,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -129359,7 +134575,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -129404,7 +134622,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -129449,7 +134669,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -129494,7 +134716,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -129539,7 +134763,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -129584,7 +134810,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -129629,7 +134857,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -129674,7 +134904,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -129719,7 +134951,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -129764,7 +134998,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -129809,7 +135045,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -129854,7 +135092,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -129899,7 +135139,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -129944,7 +135186,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -129989,7 +135233,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -130034,7 +135280,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -130079,7 +135327,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -130124,7 +135374,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -130169,7 +135421,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -130214,7 +135468,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -130259,7 +135515,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -130304,7 +135562,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -130349,7 +135609,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -130394,7 +135656,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -130439,7 +135703,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -130484,7 +135750,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -130529,7 +135797,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -130574,7 +135844,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -130619,7 +135891,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -130664,7 +135938,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -130709,7 +135985,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -130754,7 +136032,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -130799,7 +136079,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -130844,7 +136126,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -130889,7 +136173,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -130934,7 +136220,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -130979,7 +136267,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -131024,7 +136314,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -131069,7 +136361,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -131114,7 +136408,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -131159,7 +136455,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -131204,7 +136502,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -131249,7 +136549,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -131294,7 +136596,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -131339,7 +136643,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -131384,7 +136690,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -131429,7 +136737,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -131474,7 +136784,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -131519,7 +136831,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -131564,7 +136878,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -131609,7 +136925,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -131654,7 +136972,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -131699,7 +137019,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -131744,7 +137066,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -131789,7 +137113,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -131834,7 +137160,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -131879,7 +137207,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -131924,7 +137254,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -131969,7 +137301,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -132014,7 +137348,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -132059,7 +137395,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -132104,7 +137442,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -132149,7 +137489,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -132194,7 +137536,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -132239,7 +137583,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -132284,7 +137630,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -132329,7 +137677,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -132374,7 +137724,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -132419,7 +137771,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -132464,7 +137818,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -132509,7 +137865,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -132554,7 +137912,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -132599,7 +137959,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -132644,7 +138006,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -132689,7 +138053,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -132734,7 +138100,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -132779,7 +138147,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -132824,7 +138194,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -132869,7 +138241,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -132914,7 +138288,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -132959,7 +138335,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -133004,7 +138382,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -133049,7 +138429,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -133094,7 +138476,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -133139,7 +138523,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -133184,7 +138570,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -133229,7 +138617,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -133274,7 +138664,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -133319,7 +138711,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -133364,7 +138758,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -133409,7 +138805,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -133454,7 +138852,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -133499,7 +138899,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -133544,7 +138946,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -133589,7 +138993,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -133634,7 +139040,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -133679,7 +139087,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -133724,7 +139134,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -133769,7 +139181,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -133814,7 +139228,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -133859,7 +139275,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -133904,7 +139322,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -133949,7 +139369,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -133994,7 +139416,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -134039,7 +139463,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -134084,7 +139510,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -134129,7 +139557,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -134174,7 +139604,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -134219,7 +139651,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -134264,7 +139698,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -134309,7 +139745,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -134354,7 +139792,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -134399,7 +139839,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -134444,7 +139886,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -134489,7 +139933,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -134534,7 +139980,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -134579,7 +140027,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -134624,7 +140074,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -134669,7 +140121,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -134714,7 +140168,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -134759,7 +140215,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -134804,7 +140262,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -134849,7 +140309,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -134894,7 +140356,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -134939,7 +140403,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -134984,7 +140450,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -135029,7 +140497,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -135074,7 +140544,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -135119,7 +140591,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -135164,7 +140638,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -135209,7 +140685,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -135254,7 +140732,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -135299,7 +140779,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -135344,7 +140826,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -135389,7 +140873,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -135434,7 +140920,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -135479,7 +140967,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -135524,7 +141014,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -135569,7 +141061,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -135614,7 +141108,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -135659,7 +141155,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -135704,7 +141202,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -135749,7 +141249,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -135794,7 +141296,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -135839,7 +141343,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -135884,7 +141390,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -135929,7 +141437,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -135974,7 +141484,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -136019,7 +141531,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -136064,7 +141578,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -136109,7 +141625,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -136154,7 +141672,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -136199,7 +141719,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -136244,7 +141766,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -136289,7 +141813,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -136334,7 +141860,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -136379,7 +141907,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -136424,7 +141954,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -136469,7 +142001,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -136514,7 +142048,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -136559,7 +142095,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -136604,7 +142142,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -136649,7 +142189,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -136694,7 +142236,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -136739,7 +142283,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -136784,7 +142330,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -136829,7 +142377,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -136874,7 +142424,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -136919,7 +142471,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -136964,7 +142518,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -137009,7 +142565,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -137054,7 +142612,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -137099,7 +142659,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -137144,7 +142706,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -137189,7 +142753,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -137234,7 +142800,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -137279,7 +142847,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -137324,7 +142894,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -137369,7 +142941,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -137414,7 +142988,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -137459,7 +143035,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -137504,7 +143082,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -137549,7 +143129,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -137594,7 +143176,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -137639,7 +143223,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -137684,7 +143270,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -137729,7 +143317,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -137774,7 +143364,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -137819,7 +143411,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -137864,7 +143458,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -137909,7 +143505,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -137954,7 +143552,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -137999,7 +143599,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -138044,7 +143646,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -138089,7 +143693,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -138134,7 +143740,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -138179,7 +143787,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -138224,7 +143834,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -138269,7 +143881,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -138314,7 +143928,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -138359,7 +143975,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -138404,7 +144022,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -138449,7 +144069,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -138494,7 +144116,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -138539,7 +144163,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -138584,7 +144210,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -138629,7 +144257,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -138674,7 +144304,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -138713,8 +144345,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -138758,8 +144391,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -138803,8 +144437,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -138848,8 +144483,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -138893,8 +144529,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -138938,8 +144575,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -138983,8 +144621,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -139028,8 +144667,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -139073,8 +144713,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -139118,8 +144759,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -139163,8 +144805,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -139208,8 +144851,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -139253,8 +144897,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -139298,8 +144943,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -139343,8 +144989,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -139388,8 +145035,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -139433,8 +145081,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -139478,8 +145127,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -139523,8 +145173,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -139568,8 +145219,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -139613,8 +145265,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -139658,8 +145311,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -139703,8 +145357,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -139748,8 +145403,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -139793,8 +145449,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -139838,8 +145495,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -139883,8 +145541,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -139928,8 +145587,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -139973,8 +145633,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -140018,8 +145679,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -140063,8 +145725,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -140108,8 +145771,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -140153,8 +145817,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -140198,8 +145863,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -140243,8 +145909,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -140288,8 +145955,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -140333,8 +146001,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -140378,8 +146047,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -140423,8 +146093,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -140468,8 +146139,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -140513,8 +146185,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -140558,8 +146231,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -140603,8 +146277,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -140648,8 +146323,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -140693,8 +146369,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -140738,8 +146415,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -140783,8 +146461,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -140828,8 +146507,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -140873,8 +146553,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -140918,8 +146599,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -140963,8 +146645,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -141008,8 +146691,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -141053,8 +146737,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -141098,8 +146783,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -141143,8 +146829,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -141188,8 +146875,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -141233,8 +146921,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -141278,8 +146967,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -141323,8 +147013,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -141368,8 +147059,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -141413,8 +147105,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -141458,8 +147151,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -141503,8 +147197,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -141548,8 +147243,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -141593,8 +147289,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -141638,8 +147335,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -141683,8 +147381,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -141728,8 +147427,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -141773,8 +147473,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -141818,8 +147519,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -141863,8 +147565,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -141908,8 +147611,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -141953,8 +147657,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -141998,8 +147703,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -142043,8 +147749,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -142088,8 +147795,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -142133,8 +147841,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -142178,8 +147887,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -142223,8 +147933,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -142268,8 +147979,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -142313,8 +148025,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -142358,8 +148071,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -142403,8 +148117,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -142448,8 +148163,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -142493,8 +148209,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -142538,8 +148255,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -142583,8 +148301,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -142628,8 +148347,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -142673,8 +148393,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -142718,8 +148439,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -142763,8 +148485,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -142808,8 +148531,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -142853,8 +148577,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -142898,8 +148623,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -142943,8 +148669,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -142988,8 +148715,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -143033,8 +148761,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -143078,8 +148807,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -143123,8 +148853,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -143168,8 +148899,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -143213,8 +148945,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -143258,8 +148991,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -143303,8 +149037,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -143348,8 +149083,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -143393,8 +149129,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -143438,8 +149175,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -143483,8 +149221,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -143528,8 +149267,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -143573,8 +149313,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -143618,8 +149359,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -143663,8 +149405,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -143708,8 +149451,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -143753,8 +149497,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -143798,8 +149543,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -143843,8 +149589,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -143888,8 +149635,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -143933,8 +149681,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -143978,8 +149727,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -144023,8 +149773,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -144068,8 +149819,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -144113,8 +149865,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -144158,8 +149911,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -144203,8 +149957,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -144248,8 +150003,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -144293,8 +150049,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -144338,8 +150095,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -144383,8 +150141,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -144428,8 +150187,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -144473,8 +150233,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -144518,8 +150279,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -144563,8 +150325,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -144608,8 +150371,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -144653,8 +150417,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -144698,8 +150463,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -144743,8 +150509,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -144788,8 +150555,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -144833,8 +150601,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -144878,8 +150647,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -144923,8 +150693,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -144968,8 +150739,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -145013,8 +150785,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -145058,8 +150831,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -145103,8 +150877,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -145148,8 +150923,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -145193,8 +150969,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -145238,8 +151015,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -145283,8 +151061,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -145328,8 +151107,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -145373,8 +151153,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -145418,8 +151199,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -145463,8 +151245,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -145508,8 +151291,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -145553,8 +151337,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -145598,8 +151383,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -145643,8 +151429,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -145688,8 +151475,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -145733,8 +151521,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -145778,8 +151567,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -145823,8 +151613,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -145868,8 +151659,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -145913,8 +151705,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -145958,8 +151751,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -146003,8 +151797,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -146048,8 +151843,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -146093,8 +151889,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -146138,8 +151935,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -146183,8 +151981,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -146228,8 +152027,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -146273,8 +152073,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -146318,8 +152119,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -146363,8 +152165,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -146408,8 +152211,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -146453,8 +152257,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -146498,8 +152303,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -146543,8 +152349,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -146588,8 +152395,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -146633,8 +152441,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -146678,8 +152487,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -146723,8 +152533,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -146768,8 +152579,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -146813,8 +152625,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -146858,8 +152671,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -146903,8 +152717,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -146948,8 +152763,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -146993,8 +152809,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -147038,8 +152855,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -147083,8 +152901,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -147128,8 +152947,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -147173,8 +152993,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -147218,8 +153039,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -147263,8 +153085,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -147308,8 +153131,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -147353,8 +153177,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -147398,8 +153223,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -147443,8 +153269,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -147488,8 +153315,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -147533,8 +153361,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -147578,8 +153407,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -147623,8 +153453,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -147668,8 +153499,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -147713,8 +153545,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -147758,8 +153591,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -147803,8 +153637,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -147848,8 +153683,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -147893,8 +153729,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -147938,8 +153775,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -147983,8 +153821,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -148028,8 +153867,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -148073,8 +153913,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -148118,8 +153959,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -148163,8 +154005,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -148208,8 +154051,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -148253,8 +154097,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -148298,8 +154143,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -148343,8 +154189,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -148388,8 +154235,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -148433,8 +154281,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -148478,8 +154327,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -148523,8 +154373,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -148568,8 +154419,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -148613,8 +154465,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -148658,8 +154511,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -148703,8 +154557,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -148748,8 +154603,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -148793,8 +154649,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -148838,8 +154695,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -148883,8 +154741,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -148928,8 +154787,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -148973,8 +154833,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -149018,8 +154879,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -149063,8 +154925,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -149108,8 +154971,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -149153,8 +155017,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -149198,8 +155063,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -149243,8 +155109,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -149288,8 +155155,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -149333,8 +155201,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -149378,8 +155247,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -149423,8 +155293,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -149468,8 +155339,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -149513,8 +155385,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -149558,8 +155431,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -149603,8 +155477,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -149648,8 +155523,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -149693,8 +155569,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -149738,8 +155615,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -149783,8 +155661,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -149828,8 +155707,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -149873,8 +155753,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -149918,8 +155799,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -149963,8 +155845,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -150008,8 +155891,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -150053,8 +155937,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -150098,8 +155983,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -150143,8 +156029,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -150188,8 +156075,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -150233,8 +156121,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -150278,8 +156167,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -150323,8 +156213,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -150368,8 +156259,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -150413,8 +156305,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -150458,8 +156351,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -150503,8 +156397,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -150548,8 +156443,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -150593,8 +156489,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -150638,8 +156535,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -150683,8 +156581,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -150728,8 +156627,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -150773,8 +156673,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -150818,8 +156719,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -150863,8 +156765,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -150908,8 +156811,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -150953,8 +156857,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -150998,8 +156903,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -151043,8 +156949,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -151088,8 +156995,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -151133,8 +157041,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -151178,8 +157087,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -151223,8 +157133,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -151268,8 +157179,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -151313,8 +157225,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -151358,8 +157271,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -151403,8 +157317,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -151448,8 +157363,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -151493,8 +157409,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -151538,8 +157455,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -151583,8 +157501,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -151628,8 +157547,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -151673,8 +157593,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -151718,8 +157639,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -151763,8 +157685,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -151808,8 +157731,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -151853,8 +157777,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -151898,8 +157823,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -151943,8 +157869,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -151988,8 +157915,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -152033,8 +157961,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -152078,8 +158007,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -152123,8 +158053,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -152168,8 +158099,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -152213,8 +158145,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -152258,8 +158191,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -152303,8 +158237,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -152348,8 +158283,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -152393,8 +158329,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -152438,8 +158375,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -152483,8 +158421,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -152528,8 +158467,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -152573,8 +158513,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -152618,8 +158559,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -152663,8 +158605,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -152708,8 +158651,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -152753,8 +158697,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -152798,8 +158743,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -152843,8 +158789,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -152888,8 +158835,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -152933,8 +158881,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -152978,8 +158927,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -153023,8 +158973,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -153068,8 +159019,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -153113,8 +159065,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -153158,8 +159111,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -153203,8 +159157,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -153248,8 +159203,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -153293,8 +159249,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -153338,8 +159295,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -153383,8 +159341,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -153428,8 +159387,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -153473,8 +159433,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -153518,8 +159479,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -153563,8 +159525,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -153608,8 +159571,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -153653,8 +159617,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -153698,8 +159663,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -153743,8 +159709,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -153788,8 +159755,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -153833,8 +159801,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -153878,8 +159847,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -153923,8 +159893,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -153968,8 +159939,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -154013,8 +159985,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -154058,8 +160031,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -154103,8 +160077,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -154148,8 +160123,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -154193,8 +160169,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -154238,8 +160215,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -154283,8 +160261,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -154328,8 +160307,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -154373,8 +160353,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -154418,8 +160399,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -154463,8 +160445,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -154508,8 +160491,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 diff --git a/docs/mitre-map/detections.json b/docs/mitre-map/detections.json index e6a83917b9..9de8d21fc9 100644 --- a/docs/mitre-map/detections.json +++ b/docs/mitre-map/detections.json @@ -15494,2115 +15494,2115 @@ }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1060", @@ -53067,169 +53067,94 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { - "techniqueID": "T1016", - "score": 22, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml" - }, - { - "techniqueID": "T1057", - "score": 21, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml" - }, - { - "techniqueID": "T1203", - "score": 22, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" - }, - { - "techniqueID": "T1016", - "score": 22, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml" - }, - { - "techniqueID": "T1057", - "score": 21, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml" - }, - { - "techniqueID": "T1203", - "score": 22, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" - }, - { - "techniqueID": "T1016", - "score": 22, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml" - }, - { - "techniqueID": "T1057", - "score": 21, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml" - }, - { - "techniqueID": "T1203", - "score": 22, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" - }, - { - "techniqueID": "T1016", - "score": 22, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml" - }, - { - "techniqueID": "T1057", - "score": 21, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml" - }, - { - "techniqueID": "T1203", - "score": 22, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" - }, - { - "techniqueID": "T1016", - "score": 22, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml" - }, - { - "techniqueID": "T1057", - "score": 21, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml" - }, - { - "techniqueID": "T1203", - "score": 22, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" - }, - { - "techniqueID": "T1036.005", + "techniqueID": "T1016", "score": 22, - "showSubtechniques": false + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml" }, { - "techniqueID": "T1036.005", - "score": 22, - "showSubtechniques": false + "techniqueID": "T1057", + "score": 21, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml" }, { - "techniqueID": "T1036.005", + "techniqueID": "T1203", "score": 22, - "showSubtechniques": false + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { - "techniqueID": "T1036.005", + "techniqueID": "T1016", "score": 22, - "showSubtechniques": false + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml" }, { - "techniqueID": "T1036.005", - "score": 22, - "showSubtechniques": false + "techniqueID": "T1057", + "score": 21, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml" }, { - "techniqueID": "T1036.005", + "techniqueID": "T1203", "score": 22, - "showSubtechniques": false + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { - "techniqueID": "T1036.005", + "techniqueID": "T1016", "score": 22, - "showSubtechniques": false + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml" }, { - "techniqueID": "T1036.005", - "score": 22, - "showSubtechniques": false + "techniqueID": "T1057", + "score": 21, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml" }, { - "techniqueID": "T1036.005", + "techniqueID": "T1203", "score": 22, - "showSubtechniques": false + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { - "techniqueID": "T1036.005", + "techniqueID": "T1016", "score": 22, - "showSubtechniques": false + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml" }, { - "techniqueID": "T1036.005", - "score": 22, - "showSubtechniques": false + "techniqueID": "T1057", + "score": 21, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml" }, { - "techniqueID": "T1036.005", + "techniqueID": "T1203", "score": 22, - "showSubtechniques": false + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { - "techniqueID": "T1036.005", + "techniqueID": "T1016", "score": 22, - "showSubtechniques": false + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml" }, { - "techniqueID": "T1036.005", - "score": 22, - "showSubtechniques": false + "techniqueID": "T1057", + "score": 21, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml" }, { - "techniqueID": "T1036.005", + "techniqueID": "T1203", "score": 22, - "showSubtechniques": false + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1036.005", @@ -54917,195 +54842,78 @@ "showSubtechniques": false }, { - "techniqueID": "T1055", - "score": 12, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml" - }, - { - "techniqueID": "T1076", - "score": 21, - "showSubtechniques": false - }, - { - "techniqueID": "T1021.001", - "score": 21, - "showSubtechniques": false - }, - { - "techniqueID": "T1055", - "score": 12, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml" - }, - { - "techniqueID": "T1076", - "score": 21, - "showSubtechniques": false - }, - { - "techniqueID": "T1021.001", - "score": 21, - "showSubtechniques": false - }, - { - "techniqueID": "T1055", - "score": 12, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml" - }, - { - "techniqueID": "T1076", - "score": 21, - "showSubtechniques": false - }, - { - "techniqueID": "T1021.001", - "score": 21, - "showSubtechniques": false - }, - { - "techniqueID": "T1055", - "score": 12, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml" - }, - { - "techniqueID": "T1076", - "score": 21, - "showSubtechniques": false - }, - { - "techniqueID": "T1021.001", - "score": 21, - "showSubtechniques": false - }, - { - "techniqueID": "T1055", - "score": 12, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml" - }, - { - "techniqueID": "T1076", - "score": 21, - "showSubtechniques": false - }, - { - "techniqueID": "T1021.001", - "score": 21, + "techniqueID": "T1036.005", + "score": 22, "showSubtechniques": false }, { - "techniqueID": "T1055", - "score": 12, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml" - }, - { - "techniqueID": "T1076", - "score": 21, + "techniqueID": "T1036.005", + "score": 22, "showSubtechniques": false }, { - "techniqueID": "T1021.001", - "score": 21, + "techniqueID": "T1036.005", + "score": 22, "showSubtechniques": false }, { - "techniqueID": "T1055", - "score": 12, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml" - }, - { - "techniqueID": "T1076", - "score": 21, + "techniqueID": "T1036.005", + "score": 22, "showSubtechniques": false }, { - "techniqueID": "T1021.001", - "score": 21, + "techniqueID": "T1036.005", + "score": 22, "showSubtechniques": false }, { - "techniqueID": "T1055", - "score": 12, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml" - }, - { - "techniqueID": "T1076", - "score": 21, + "techniqueID": "T1036.005", + "score": 22, "showSubtechniques": false }, { - "techniqueID": "T1021.001", - "score": 21, + "techniqueID": "T1036.005", + "score": 22, "showSubtechniques": false }, { - "techniqueID": "T1055", - "score": 12, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml" - }, - { - "techniqueID": "T1076", - "score": 21, + "techniqueID": "T1036.005", + "score": 22, "showSubtechniques": false }, { - "techniqueID": "T1021.001", - "score": 21, + "techniqueID": "T1036.005", + "score": 22, "showSubtechniques": false }, { - "techniqueID": "T1055", - "score": 12, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml" - }, - { - "techniqueID": "T1076", - "score": 21, + "techniqueID": "T1036.005", + "score": 22, "showSubtechniques": false }, { - "techniqueID": "T1021.001", - "score": 21, + "techniqueID": "T1036.005", + "score": 22, "showSubtechniques": false }, { - "techniqueID": "T1055", - "score": 12, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml" - }, - { - "techniqueID": "T1076", - "score": 21, + "techniqueID": "T1036.005", + "score": 22, "showSubtechniques": false }, { - "techniqueID": "T1021.001", - "score": 21, + "techniqueID": "T1036.005", + "score": 22, "showSubtechniques": false }, { - "techniqueID": "T1055", - "score": 12, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml" - }, - { - "techniqueID": "T1076", - "score": 21, + "techniqueID": "T1036.005", + "score": 22, "showSubtechniques": false }, { - "techniqueID": "T1021.001", - "score": 21, + "techniqueID": "T1036.005", + "score": 22, "showSubtechniques": false }, { @@ -60549,273 +60357,195 @@ "showSubtechniques": false }, { - "techniqueID": "T1056.001", - "score": 20, - "showSubtechniques": false - }, - { - "techniqueID": "T1140", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml" - }, - { - "techniqueID": "T1059", - "score": 16, + "techniqueID": "T1055", + "score": 12, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml" - }, - { - "techniqueID": "T1018", - "score": 20, - "showSubtechniques": false + "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml" }, { - "techniqueID": "T1204.001", - "score": 20, + "techniqueID": "T1076", + "score": 21, "showSubtechniques": false }, { - "techniqueID": "T1056.001", - "score": 20, + "techniqueID": "T1021.001", + "score": 21, "showSubtechniques": false }, { - "techniqueID": "T1140", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml" - }, - { - "techniqueID": "T1059", - "score": 16, + "techniqueID": "T1055", + "score": 12, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml" - }, - { - "techniqueID": "T1018", - "score": 20, - "showSubtechniques": false + "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml" }, { - "techniqueID": "T1204.001", - "score": 20, + "techniqueID": "T1076", + "score": 21, "showSubtechniques": false }, { - "techniqueID": "T1056.001", - "score": 20, + "techniqueID": "T1021.001", + "score": 21, "showSubtechniques": false }, { - "techniqueID": "T1140", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml" - }, - { - "techniqueID": "T1059", - "score": 16, + "techniqueID": "T1055", + "score": 12, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml" - }, - { - "techniqueID": "T1018", - "score": 20, - "showSubtechniques": false + "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml" }, { - "techniqueID": "T1204.001", - "score": 20, + "techniqueID": "T1076", + "score": 21, "showSubtechniques": false }, { - "techniqueID": "T1056.001", - "score": 20, + "techniqueID": "T1021.001", + "score": 21, "showSubtechniques": false }, { - "techniqueID": "T1140", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml" - }, - { - "techniqueID": "T1059", - "score": 16, + "techniqueID": "T1055", + "score": 12, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml" - }, - { - "techniqueID": "T1018", - "score": 20, - "showSubtechniques": false + "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml" }, { - "techniqueID": "T1204.001", - "score": 20, + "techniqueID": "T1076", + "score": 21, "showSubtechniques": false }, { - "techniqueID": "T1056.001", - "score": 20, + "techniqueID": "T1021.001", + "score": 21, "showSubtechniques": false }, { - "techniqueID": "T1140", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml" - }, - { - "techniqueID": "T1059", - "score": 16, + "techniqueID": "T1055", + "score": 12, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml" - }, - { - "techniqueID": "T1018", - "score": 20, - "showSubtechniques": false + "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml" }, { - "techniqueID": "T1204.001", - "score": 20, + "techniqueID": "T1076", + "score": 21, "showSubtechniques": false }, { - "techniqueID": "T1056.001", - "score": 20, + "techniqueID": "T1021.001", + "score": 21, "showSubtechniques": false }, { - "techniqueID": "T1140", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml" - }, - { - "techniqueID": "T1059", - "score": 16, + "techniqueID": "T1055", + "score": 12, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml" - }, - { - "techniqueID": "T1018", - "score": 20, - "showSubtechniques": false + "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml" }, { - "techniqueID": "T1204.001", - "score": 20, + "techniqueID": "T1076", + "score": 21, "showSubtechniques": false }, { - "techniqueID": "T1056.001", - "score": 20, + "techniqueID": "T1021.001", + "score": 21, "showSubtechniques": false }, { - "techniqueID": "T1140", - "score": 19, + "techniqueID": "T1055", + "score": 12, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml" }, { - "techniqueID": "T1059", - "score": 16, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml" + "techniqueID": "T1076", + "score": 21, + "showSubtechniques": false }, { - "techniqueID": "T1018", - "score": 20, + "techniqueID": "T1021.001", + "score": 21, "showSubtechniques": false }, { - "techniqueID": "T1204.001", - "score": 20, - "showSubtechniques": false + "techniqueID": "T1055", + "score": 12, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml" }, { - "techniqueID": "T1056.001", - "score": 20, + "techniqueID": "T1076", + "score": 21, "showSubtechniques": false }, { - "techniqueID": "T1140", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml" + "techniqueID": "T1021.001", + "score": 21, + "showSubtechniques": false }, { - "techniqueID": "T1059", - "score": 16, + "techniqueID": "T1055", + "score": 12, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml" - }, - { - "techniqueID": "T1018", - "score": 20, - "showSubtechniques": false + "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml" }, { - "techniqueID": "T1204.001", - "score": 20, + "techniqueID": "T1076", + "score": 21, "showSubtechniques": false }, { - "techniqueID": "T1056.001", - "score": 20, + "techniqueID": "T1021.001", + "score": 21, "showSubtechniques": false }, { - "techniqueID": "T1140", - "score": 19, + "techniqueID": "T1055", + "score": 12, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml" }, { - "techniqueID": "T1059", - "score": 16, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml" + "techniqueID": "T1076", + "score": 21, + "showSubtechniques": false }, { - "techniqueID": "T1018", - "score": 20, + "techniqueID": "T1021.001", + "score": 21, "showSubtechniques": false }, { - "techniqueID": "T1204.001", - "score": 20, - "showSubtechniques": false + "techniqueID": "T1055", + "score": 12, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml" }, { - "techniqueID": "T1056.001", - "score": 20, + "techniqueID": "T1076", + "score": 21, "showSubtechniques": false }, { - "techniqueID": "T1140", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml" + "techniqueID": "T1021.001", + "score": 21, + "showSubtechniques": false }, { - "techniqueID": "T1059", - "score": 16, + "techniqueID": "T1055", + "score": 12, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml" }, { - "techniqueID": "T1018", - "score": 20, + "techniqueID": "T1076", + "score": 21, "showSubtechniques": false }, { - "techniqueID": "T1204.001", - "score": 20, + "techniqueID": "T1021.001", + "score": 21, "showSubtechniques": false }, { @@ -70053,89 +69783,274 @@ "showSubtechniques": false }, { - "techniqueID": "T1047", - "score": 14, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml" + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": false }, { - "techniqueID": "T1033", + "techniqueID": "T1140", "score": 19, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml" + }, + { + "techniqueID": "T1059", + "score": 16, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml" + }, + { + "techniqueID": "T1018", + "score": 20, "showSubtechniques": false }, { - "techniqueID": "T1189", - "score": 18, + "techniqueID": "T1204.001", + "score": 20, + "showSubtechniques": false + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": false + }, + { + "techniqueID": "T1140", + "score": 19, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml" }, { - "techniqueID": "T1047", - "score": 14, + "techniqueID": "T1059", + "score": 16, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml" }, { - "techniqueID": "T1033", + "techniqueID": "T1018", + "score": 20, + "showSubtechniques": false + }, + { + "techniqueID": "T1204.001", + "score": 20, + "showSubtechniques": false + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": false + }, + { + "techniqueID": "T1140", "score": 19, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml" + }, + { + "techniqueID": "T1059", + "score": 16, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml" + }, + { + "techniqueID": "T1018", + "score": 20, "showSubtechniques": false }, { - "techniqueID": "T1189", - "score": 18, + "techniqueID": "T1204.001", + "score": 20, + "showSubtechniques": false + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": false + }, + { + "techniqueID": "T1140", + "score": 19, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml" }, { - "techniqueID": "T1047", - "score": 14, + "techniqueID": "T1059", + "score": 16, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml" }, { - "techniqueID": "T1033", + "techniqueID": "T1018", + "score": 20, + "showSubtechniques": false + }, + { + "techniqueID": "T1204.001", + "score": 20, + "showSubtechniques": false + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": false + }, + { + "techniqueID": "T1140", "score": 19, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml" + }, + { + "techniqueID": "T1059", + "score": 16, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml" + }, + { + "techniqueID": "T1018", + "score": 20, "showSubtechniques": false }, { - "techniqueID": "T1189", - "score": 18, + "techniqueID": "T1204.001", + "score": 20, + "showSubtechniques": false + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": false + }, + { + "techniqueID": "T1140", + "score": 19, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml" }, { - "techniqueID": "T1047", - "score": 14, + "techniqueID": "T1059", + "score": 16, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml" }, { - "techniqueID": "T1033", + "techniqueID": "T1018", + "score": 20, + "showSubtechniques": false + }, + { + "techniqueID": "T1204.001", + "score": 20, + "showSubtechniques": false + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": false + }, + { + "techniqueID": "T1140", "score": 19, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml" + }, + { + "techniqueID": "T1059", + "score": 16, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml" + }, + { + "techniqueID": "T1018", + "score": 20, "showSubtechniques": false }, { - "techniqueID": "T1189", - "score": 18, + "techniqueID": "T1204.001", + "score": 20, + "showSubtechniques": false + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": false + }, + { + "techniqueID": "T1140", + "score": 19, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml" }, { - "techniqueID": "T1047", - "score": 14, + "techniqueID": "T1059", + "score": 16, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml" }, { - "techniqueID": "T1033", + "techniqueID": "T1018", + "score": 20, + "showSubtechniques": false + }, + { + "techniqueID": "T1204.001", + "score": 20, + "showSubtechniques": false + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": false + }, + { + "techniqueID": "T1140", "score": 19, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml" + }, + { + "techniqueID": "T1059", + "score": 16, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml" + }, + { + "techniqueID": "T1018", + "score": 20, "showSubtechniques": false }, { - "techniqueID": "T1189", - "score": 18, + "techniqueID": "T1204.001", + "score": 20, + "showSubtechniques": false + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": false + }, + { + "techniqueID": "T1140", + "score": 19, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml" + }, + { + "techniqueID": "T1059", + "score": 16, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml" + }, + { + "techniqueID": "T1018", + "score": 20, + "showSubtechniques": false + }, + { + "techniqueID": "T1204.001", + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1047", @@ -76037,34 +75952,89 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, { - "techniqueID": "T1560.001", - "score": 18, + "techniqueID": "T1047", + "score": 14, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1033", + "score": 19, "showSubtechniques": false }, { - "techniqueID": "T1560.001", + "techniqueID": "T1189", "score": 18, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1047", + "score": 14, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1033", + "score": 19, "showSubtechniques": false }, { - "techniqueID": "T1560.001", + "techniqueID": "T1189", "score": 18, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1047", + "score": 14, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1033", + "score": 19, "showSubtechniques": false }, { - "techniqueID": "T1560.001", + "techniqueID": "T1189", "score": 18, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1047", + "score": 14, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1033", + "score": 19, "showSubtechniques": false }, { - "techniqueID": "T1560.001", + "techniqueID": "T1189", "score": 18, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1047", + "score": 14, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1033", + "score": 19, "showSubtechniques": false }, { - "techniqueID": "T1560.001", + "techniqueID": "T1189", "score": 18, - "showSubtechniques": false + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1560.001", @@ -77797,184 +77767,34 @@ "showSubtechniques": false }, { - "techniqueID": "T1003", - "score": 6, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml" - }, - { - "techniqueID": "T1543.003", - "score": 16, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" - }, - { - "techniqueID": "T1003", - "score": 6, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml" - }, - { - "techniqueID": "T1543.003", - "score": 16, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" - }, - { - "techniqueID": "T1003", - "score": 6, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml" - }, - { - "techniqueID": "T1543.003", - "score": 16, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" - }, - { - "techniqueID": "T1003", - "score": 6, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml" - }, - { - "techniqueID": "T1543.003", - "score": 16, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" - }, - { - "techniqueID": "T1003", - "score": 6, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml" - }, - { - "techniqueID": "T1543.003", - "score": 16, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" - }, - { - "techniqueID": "T1003", - "score": 6, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml" - }, - { - "techniqueID": "T1543.003", - "score": 16, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" - }, - { - "techniqueID": "T1003", - "score": 6, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml" - }, - { - "techniqueID": "T1543.003", - "score": 16, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" - }, - { - "techniqueID": "T1003", - "score": 6, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml" - }, - { - "techniqueID": "T1543.003", - "score": 16, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" - }, - { - "techniqueID": "T1003", - "score": 6, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml" - }, - { - "techniqueID": "T1543.003", - "score": 16, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" - }, - { - "techniqueID": "T1003", - "score": 6, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml" - }, - { - "techniqueID": "T1543.003", - "score": 16, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" - }, - { - "techniqueID": "T1003", - "score": 6, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml" - }, - { - "techniqueID": "T1543.003", - "score": 16, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" - }, - { - "techniqueID": "T1003", - "score": 6, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml" - }, - { - "techniqueID": "T1543.003", - "score": 16, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" - }, - { - "techniqueID": "T1003", - "score": 6, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml" + "techniqueID": "T1560.001", + "score": 18, + "showSubtechniques": false }, { - "techniqueID": "T1543.003", - "score": 16, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + "techniqueID": "T1560.001", + "score": 18, + "showSubtechniques": false }, { - "techniqueID": "T1003", - "score": 6, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml" + "techniqueID": "T1560.001", + "score": 18, + "showSubtechniques": false }, { - "techniqueID": "T1543.003", - "score": 16, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + "techniqueID": "T1560.001", + "score": 18, + "showSubtechniques": false }, { - "techniqueID": "T1003", - "score": 6, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml" + "techniqueID": "T1560.001", + "score": 18, + "showSubtechniques": false }, { - "techniqueID": "T1543.003", - "score": 16, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + "techniqueID": "T1560.001", + "score": 18, + "showSubtechniques": false }, { "techniqueID": "T1003", @@ -82021,108 +81841,184 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" }, { - "techniqueID": "T1116", - "score": 16, - "showSubtechniques": false + "techniqueID": "T1003", + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml" }, { - "techniqueID": "T1553.002", + "techniqueID": "T1543.003", "score": 16, - "showSubtechniques": false + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" }, { - "techniqueID": "T1503", + "techniqueID": "T1003", + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml" + }, + { + "techniqueID": "T1543.003", "score": 16, - "showSubtechniques": false + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" }, { - "techniqueID": "T1112", - "score": 14, + "techniqueID": "T1003", + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml" }, { - "techniqueID": "T1555.003", + "techniqueID": "T1543.003", "score": 16, - "showSubtechniques": false + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" }, { - "techniqueID": "T1116", + "techniqueID": "T1003", + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml" + }, + { + "techniqueID": "T1543.003", "score": 16, - "showSubtechniques": false + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" }, { - "techniqueID": "T1553.002", + "techniqueID": "T1003", + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml" + }, + { + "techniqueID": "T1543.003", "score": 16, - "showSubtechniques": false + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" }, { - "techniqueID": "T1503", + "techniqueID": "T1003", + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml" + }, + { + "techniqueID": "T1543.003", "score": 16, - "showSubtechniques": false + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" }, { - "techniqueID": "T1112", - "score": 14, + "techniqueID": "T1003", + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml" }, { - "techniqueID": "T1555.003", + "techniqueID": "T1543.003", "score": 16, - "showSubtechniques": false + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" }, { - "techniqueID": "T1116", + "techniqueID": "T1003", + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml" + }, + { + "techniqueID": "T1543.003", "score": 16, - "showSubtechniques": false + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" }, { - "techniqueID": "T1553.002", + "techniqueID": "T1003", + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml" + }, + { + "techniqueID": "T1543.003", "score": 16, - "showSubtechniques": false + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" }, { - "techniqueID": "T1503", + "techniqueID": "T1003", + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml" + }, + { + "techniqueID": "T1543.003", "score": 16, - "showSubtechniques": false + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" }, { - "techniqueID": "T1112", - "score": 14, + "techniqueID": "T1003", + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml" }, { - "techniqueID": "T1555.003", + "techniqueID": "T1543.003", "score": 16, - "showSubtechniques": false + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" }, { - "techniqueID": "T1116", + "techniqueID": "T1003", + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml" + }, + { + "techniqueID": "T1543.003", "score": 16, - "showSubtechniques": false + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" }, { - "techniqueID": "T1553.002", + "techniqueID": "T1003", + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml" + }, + { + "techniqueID": "T1543.003", "score": 16, - "showSubtechniques": false + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" }, { - "techniqueID": "T1503", + "techniqueID": "T1003", + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml" + }, + { + "techniqueID": "T1543.003", "score": 16, - "showSubtechniques": false + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" }, { - "techniqueID": "T1112", - "score": 14, + "techniqueID": "T1003", + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml" }, { - "techniqueID": "T1555.003", + "techniqueID": "T1543.003", "score": 16, - "showSubtechniques": false + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" }, { "techniqueID": "T1116", @@ -91173,103 +91069,107 @@ "showSubtechniques": false }, { - "techniqueID": "T1043", - "score": 15, + "techniqueID": "T1116", + "score": 16, "showSubtechniques": false }, { - "techniqueID": "T1043", - "score": 15, + "techniqueID": "T1553.002", + "score": 16, "showSubtechniques": false }, { - "techniqueID": "T1043", - "score": 15, + "techniqueID": "T1503", + "score": 16, "showSubtechniques": false }, { - "techniqueID": "T1043", - "score": 15, - "showSubtechniques": false + "techniqueID": "T1112", + "score": 14, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml" }, { - "techniqueID": "T1043", - "score": 15, + "techniqueID": "T1555.003", + "score": 16, "showSubtechniques": false }, { - "techniqueID": "T1043", - "score": 15, + "techniqueID": "T1116", + "score": 16, "showSubtechniques": false }, { - "techniqueID": "T1043", - "score": 15, + "techniqueID": "T1553.002", + "score": 16, "showSubtechniques": false }, { - "techniqueID": "T1043", - "score": 15, + "techniqueID": "T1503", + "score": 16, "showSubtechniques": false }, { - "techniqueID": "T1043", - "score": 15, - "showSubtechniques": false + "techniqueID": "T1112", + "score": 14, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml" }, { - "techniqueID": "T1043", - "score": 15, + "techniqueID": "T1555.003", + "score": 16, "showSubtechniques": false }, { - "techniqueID": "T1043", - "score": 15, + "techniqueID": "T1116", + "score": 16, "showSubtechniques": false }, { - "techniqueID": "T1043", - "score": 15, + "techniqueID": "T1553.002", + "score": 16, "showSubtechniques": false }, { - "techniqueID": "T1043", - "score": 15, + "techniqueID": "T1503", + "score": 16, "showSubtechniques": false }, { - "techniqueID": "T1043", - "score": 15, - "showSubtechniques": false + "techniqueID": "T1112", + "score": 14, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml" }, { - "techniqueID": "T1043", - "score": 15, + "techniqueID": "T1555.003", + "score": 16, "showSubtechniques": false }, { - "techniqueID": "T1043", - "score": 15, + "techniqueID": "T1116", + "score": 16, "showSubtechniques": false }, { - "techniqueID": "T1043", - "score": 15, + "techniqueID": "T1553.002", + "score": 16, "showSubtechniques": false }, { - "techniqueID": "T1043", - "score": 15, + "techniqueID": "T1503", + "score": 16, "showSubtechniques": false }, { - "techniqueID": "T1043", - "score": 15, - "showSubtechniques": false + "techniqueID": "T1112", + "score": 14, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml" }, { - "techniqueID": "T1043", - "score": 15, + "techniqueID": "T1555.003", + "score": 16, "showSubtechniques": false }, { @@ -92933,108 +92833,103 @@ "showSubtechniques": false }, { - "techniqueID": "T1133", - "score": 14, + "techniqueID": "T1043", + "score": 15, "showSubtechniques": false }, { - "techniqueID": "T1087.001", - "score": 14, + "techniqueID": "T1043", + "score": 15, "showSubtechniques": false }, { - "techniqueID": "T1136.001", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml" + "techniqueID": "T1043", + "score": 15, + "showSubtechniques": false }, { - "techniqueID": "T1049", - "score": 14, + "techniqueID": "T1043", + "score": 15, "showSubtechniques": false }, { - "techniqueID": "T1133", - "score": 14, + "techniqueID": "T1043", + "score": 15, "showSubtechniques": false }, { - "techniqueID": "T1087.001", - "score": 14, + "techniqueID": "T1043", + "score": 15, "showSubtechniques": false }, { - "techniqueID": "T1136.001", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml" + "techniqueID": "T1043", + "score": 15, + "showSubtechniques": false }, { - "techniqueID": "T1049", - "score": 14, + "techniqueID": "T1043", + "score": 15, "showSubtechniques": false }, { - "techniqueID": "T1133", - "score": 14, + "techniqueID": "T1043", + "score": 15, "showSubtechniques": false }, { - "techniqueID": "T1087.001", - "score": 14, + "techniqueID": "T1043", + "score": 15, "showSubtechniques": false }, { - "techniqueID": "T1136.001", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml" + "techniqueID": "T1043", + "score": 15, + "showSubtechniques": false }, { - "techniqueID": "T1049", - "score": 14, + "techniqueID": "T1043", + "score": 15, "showSubtechniques": false }, { - "techniqueID": "T1133", - "score": 14, + "techniqueID": "T1043", + "score": 15, "showSubtechniques": false }, { - "techniqueID": "T1087.001", - "score": 14, + "techniqueID": "T1043", + "score": 15, "showSubtechniques": false }, { - "techniqueID": "T1136.001", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml" + "techniqueID": "T1043", + "score": 15, + "showSubtechniques": false }, { - "techniqueID": "T1049", - "score": 14, + "techniqueID": "T1043", + "score": 15, "showSubtechniques": false }, { - "techniqueID": "T1133", - "score": 14, + "techniqueID": "T1043", + "score": 15, "showSubtechniques": false }, { - "techniqueID": "T1087.001", - "score": 14, + "techniqueID": "T1043", + "score": 15, "showSubtechniques": false }, { - "techniqueID": "T1136.001", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml" + "techniqueID": "T1043", + "score": 15, + "showSubtechniques": false }, { - "techniqueID": "T1049", - "score": 14, + "techniqueID": "T1043", + "score": 15, "showSubtechniques": false }, { @@ -100325,195 +100220,110 @@ "showSubtechniques": false }, { - "techniqueID": "T1218.011", - "score": 5, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" + "techniqueID": "T1133", + "score": 14, + "showSubtechniques": false }, { - "techniqueID": "T1074.001", - "score": 13, + "techniqueID": "T1087.001", + "score": 14, "showSubtechniques": false }, { - "techniqueID": "T1021.002", - "score": 9, + "techniqueID": "T1136.001", + "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml" }, { - "techniqueID": "T1085", - "score": 13, + "techniqueID": "T1049", + "score": 14, "showSubtechniques": false }, { - "techniqueID": "T1045", - "score": 13, + "techniqueID": "T1133", + "score": 14, "showSubtechniques": false }, { - "techniqueID": "T1027.002", - "score": 13, + "techniqueID": "T1087.001", + "score": 14, "showSubtechniques": false }, { - "techniqueID": "T1046", + "techniqueID": "T1136.001", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml" - }, - { - "techniqueID": "T1218.011", - "score": 5, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" - }, - { - "techniqueID": "T1074.001", - "score": 13, - "showSubtechniques": false - }, - { - "techniqueID": "T1021.002", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml" }, { - "techniqueID": "T1085", - "score": 13, + "techniqueID": "T1049", + "score": 14, "showSubtechniques": false }, { - "techniqueID": "T1045", - "score": 13, + "techniqueID": "T1133", + "score": 14, "showSubtechniques": false }, { - "techniqueID": "T1027.002", - "score": 13, + "techniqueID": "T1087.001", + "score": 14, "showSubtechniques": false }, { - "techniqueID": "T1046", + "techniqueID": "T1136.001", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml" - }, - { - "techniqueID": "T1218.011", - "score": 5, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" - }, - { - "techniqueID": "T1074.001", - "score": 13, - "showSubtechniques": false - }, - { - "techniqueID": "T1021.002", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml" }, { - "techniqueID": "T1085", - "score": 13, + "techniqueID": "T1049", + "score": 14, "showSubtechniques": false }, { - "techniqueID": "T1045", - "score": 13, + "techniqueID": "T1133", + "score": 14, "showSubtechniques": false }, { - "techniqueID": "T1027.002", - "score": 13, + "techniqueID": "T1087.001", + "score": 14, "showSubtechniques": false }, { - "techniqueID": "T1046", + "techniqueID": "T1136.001", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml" - }, - { - "techniqueID": "T1218.011", - "score": 5, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" - }, - { - "techniqueID": "T1074.001", - "score": 13, - "showSubtechniques": false - }, - { - "techniqueID": "T1021.002", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml" }, { - "techniqueID": "T1085", - "score": 13, + "techniqueID": "T1049", + "score": 14, "showSubtechniques": false }, { - "techniqueID": "T1045", - "score": 13, + "techniqueID": "T1133", + "score": 14, "showSubtechniques": false }, { - "techniqueID": "T1027.002", - "score": 13, + "techniqueID": "T1087.001", + "score": 14, "showSubtechniques": false }, { - "techniqueID": "T1046", + "techniqueID": "T1136.001", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml" - }, - { - "techniqueID": "T1218.011", - "score": 5, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" - }, - { - "techniqueID": "T1074.001", - "score": 13, - "showSubtechniques": false - }, - { - "techniqueID": "T1021.002", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1085", - "score": 13, - "showSubtechniques": false - }, - { - "techniqueID": "T1045", - "score": 13, - "showSubtechniques": false + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml" }, { - "techniqueID": "T1027.002", - "score": 13, + "techniqueID": "T1049", + "score": 14, "showSubtechniques": false }, - { - "techniqueID": "T1046", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml" - }, { "techniqueID": "T1218.011", "score": 5, @@ -113701,244 +113511,194 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml" }, { - "techniqueID": "T1113", - "score": 11, + "techniqueID": "T1218.011", + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1087.002", - "score": 12, - "showSubtechniques": false + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { - "techniqueID": "T1063", - "score": 12, + "techniqueID": "T1074.001", + "score": 13, "showSubtechniques": false }, { - "techniqueID": "T1190", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" - }, - { - "techniqueID": "T1555", + "techniqueID": "T1021.002", "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { - "techniqueID": "T1036", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" + "techniqueID": "T1085", + "score": 13, + "showSubtechniques": false }, { - "techniqueID": "T1560", - "score": 12, + "techniqueID": "T1045", + "score": 13, "showSubtechniques": false }, { - "techniqueID": "T1136.002", - "score": 12, + "techniqueID": "T1027.002", + "score": 13, "showSubtechniques": false }, { - "techniqueID": "T1041", - "score": 12, - "showSubtechniques": false + "techniqueID": "T1046", + "score": 11, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml" }, { - "techniqueID": "T1562.001", - "score": 9, + "techniqueID": "T1218.011", + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { - "techniqueID": "T1518.001", - "score": 12, + "techniqueID": "T1074.001", + "score": 13, "showSubtechniques": false }, { - "techniqueID": "T1113", - "score": 11, + "techniqueID": "T1021.002", + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { - "techniqueID": "T1087.002", - "score": 12, + "techniqueID": "T1085", + "score": 13, "showSubtechniques": false }, { - "techniqueID": "T1063", - "score": 12, + "techniqueID": "T1045", + "score": 13, "showSubtechniques": false }, { - "techniqueID": "T1190", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" + "techniqueID": "T1027.002", + "score": 13, + "showSubtechniques": false }, { - "techniqueID": "T1555", - "score": 9, + "techniqueID": "T1046", + "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml" }, { - "techniqueID": "T1036", - "score": 9, + "techniqueID": "T1218.011", + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" - }, - { - "techniqueID": "T1560", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1136.002", - "score": 12, - "showSubtechniques": false + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { - "techniqueID": "T1041", - "score": 12, + "techniqueID": "T1074.001", + "score": 13, "showSubtechniques": false }, { - "techniqueID": "T1562.001", + "techniqueID": "T1021.002", "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { - "techniqueID": "T1518.001", - "score": 12, + "techniqueID": "T1085", + "score": 13, "showSubtechniques": false }, { - "techniqueID": "T1113", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1087.002", - "score": 12, + "techniqueID": "T1045", + "score": 13, "showSubtechniques": false }, { - "techniqueID": "T1063", - "score": 12, + "techniqueID": "T1027.002", + "score": 13, "showSubtechniques": false }, { - "techniqueID": "T1190", + "techniqueID": "T1046", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" - }, - { - "techniqueID": "T1555", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml" }, { - "techniqueID": "T1036", - "score": 9, + "techniqueID": "T1218.011", + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" - }, - { - "techniqueID": "T1560", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1136.002", - "score": 12, - "showSubtechniques": false + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { - "techniqueID": "T1041", - "score": 12, + "techniqueID": "T1074.001", + "score": 13, "showSubtechniques": false }, { - "techniqueID": "T1562.001", + "techniqueID": "T1021.002", "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { - "techniqueID": "T1518.001", - "score": 12, + "techniqueID": "T1085", + "score": 13, "showSubtechniques": false }, { - "techniqueID": "T1113", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1087.002", - "score": 12, + "techniqueID": "T1045", + "score": 13, "showSubtechniques": false }, { - "techniqueID": "T1063", - "score": 12, + "techniqueID": "T1027.002", + "score": 13, "showSubtechniques": false }, { - "techniqueID": "T1190", + "techniqueID": "T1046", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml" }, { - "techniqueID": "T1555", - "score": 9, + "techniqueID": "T1218.011", + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { - "techniqueID": "T1036", + "techniqueID": "T1074.001", + "score": 13, + "showSubtechniques": false + }, + { + "techniqueID": "T1021.002", "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { - "techniqueID": "T1560", - "score": 12, + "techniqueID": "T1085", + "score": 13, "showSubtechniques": false }, { - "techniqueID": "T1136.002", - "score": 12, + "techniqueID": "T1045", + "score": 13, "showSubtechniques": false }, { - "techniqueID": "T1041", - "score": 12, + "techniqueID": "T1027.002", + "score": 13, "showSubtechniques": false }, { - "techniqueID": "T1562.001", - "score": 9, + "techniqueID": "T1046", + "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" - }, - { - "techniqueID": "T1518.001", - "score": 12, - "showSubtechniques": false + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml" }, { "techniqueID": "T1113", @@ -113991,9 +113751,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -114051,9 +113811,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -114111,9 +113871,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -114171,9 +113931,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -114231,9 +113991,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -114291,9 +114051,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -114351,9 +114111,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -114411,9 +114171,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -114471,9 +114231,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -114531,9 +114291,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -114591,9 +114351,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -114651,9 +114411,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -114711,9 +114471,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -114771,9 +114531,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -114831,9 +114591,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -114891,9 +114651,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -114951,9 +114711,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -115011,9 +114771,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -115071,9 +114831,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -115131,9 +114891,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -115191,9 +114951,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -115251,9 +115011,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -115311,9 +115071,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -115371,9 +115131,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -115431,9 +115191,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -115491,9 +115251,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -115551,9 +115311,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -115611,9 +115371,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -115671,9 +115431,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -115731,9 +115491,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -115791,9 +115551,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -115851,9 +115611,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -115911,9 +115671,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -115971,9 +115731,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -116031,9 +115791,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -116091,9 +115851,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -116151,9 +115911,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -116211,9 +115971,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -116271,9 +116031,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -116331,9 +116091,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -116391,9 +116151,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -116451,9 +116211,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -116511,9 +116271,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -116571,9 +116331,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -116631,9 +116391,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -116691,9 +116451,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -116751,9 +116511,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -116811,9 +116571,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -116871,9 +116631,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -116931,9 +116691,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -116991,9 +116751,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -117051,9 +116811,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -117111,9 +116871,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -117171,9 +116931,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -117231,9 +116991,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -117291,9 +117051,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -117351,9 +117111,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -117411,9 +117171,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -117471,9 +117231,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -117531,9 +117291,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -117591,9 +117351,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -117651,9 +117411,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -117711,9 +117471,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -117771,9 +117531,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -117831,9 +117591,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -117891,9 +117651,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -117951,9 +117711,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -118011,9 +117771,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -118071,9 +117831,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -118131,9 +117891,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -118191,9 +117951,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -118251,9 +118011,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -118311,9 +118071,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -118371,9 +118131,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -118431,9 +118191,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -118491,9 +118251,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -118551,9 +118311,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -118611,9 +118371,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -118671,9 +118431,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -118731,9 +118491,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -118791,9 +118551,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -118851,9 +118611,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -118911,9 +118671,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -118971,9 +118731,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -119031,9 +118791,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -119091,9 +118851,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -119151,9 +118911,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -119211,9 +118971,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -119271,9 +119031,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -119331,9 +119091,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -119391,9 +119151,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -119451,9 +119211,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -119511,9 +119271,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -119571,9 +119331,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -119631,9 +119391,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -119691,9 +119451,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -119751,9 +119511,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -119811,9 +119571,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -119871,9 +119631,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -119931,9 +119691,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -119991,9 +119751,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -120051,9 +119811,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -120111,9 +119871,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -120171,9 +119931,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -120231,9 +119991,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -120291,9 +120051,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -120351,9 +120111,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -120411,9 +120171,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -120471,9 +120231,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -120531,9 +120291,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -120591,9 +120351,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -120651,9 +120411,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -120711,9 +120471,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -120771,9 +120531,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -120831,9 +120591,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -120891,9 +120651,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -120951,9 +120711,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -121011,9 +120771,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -121071,9 +120831,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -121131,9 +120891,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -121191,9 +120951,69 @@ }, { "techniqueID": "T1562.001", + "score": -2, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + }, + { + "techniqueID": "T1518.001", + "score": 12, + "showSubtechniques": false + }, + { + "techniqueID": "T1113", + "score": 11, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1087.002", + "score": 12, + "showSubtechniques": false + }, + { + "techniqueID": "T1063", + "score": 12, + "showSubtechniques": false + }, + { + "techniqueID": "T1190", + "score": 11, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" + }, + { + "techniqueID": "T1555", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml" + }, + { + "techniqueID": "T1036", "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": false + }, + { + "techniqueID": "T1136.002", + "score": 12, + "showSubtechniques": false + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": false + }, + { + "techniqueID": "T1562.001", + "score": -2, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -121251,9 +121071,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -121311,9 +121131,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -121371,9 +121191,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -121431,9 +121251,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -121491,9 +121311,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -121551,9 +121371,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -121611,9 +121431,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -121671,9 +121491,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -121731,9 +121551,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -121791,9 +121611,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -121851,9 +121671,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -121911,9 +121731,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -121971,9 +121791,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -122031,9 +121851,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -122091,9 +121911,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -122151,9 +121971,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -122211,9 +122031,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -122271,9 +122091,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -122331,9 +122151,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -122391,9 +122211,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -122451,9 +122271,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -122511,9 +122331,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -122571,9 +122391,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -122631,9 +122451,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -122691,9 +122511,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -122751,9 +122571,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -122811,9 +122631,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -122871,9 +122691,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -122931,9 +122751,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -122991,9 +122811,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -123051,9 +122871,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -123111,9 +122931,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -123171,9 +122991,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -123231,9 +123051,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -123291,9 +123111,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -123351,9 +123171,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -123411,9 +123231,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -123471,9 +123291,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -123531,9 +123351,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -123591,9 +123411,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -123651,9 +123471,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -123711,9 +123531,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -123771,9 +123591,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -123831,9 +123651,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -123891,9 +123711,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -123951,9 +123771,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -124011,9 +123831,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -124071,9 +123891,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -124131,9 +123951,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -124191,9 +124011,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -124251,9 +124071,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -124311,9 +124131,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -124371,9 +124191,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -124431,9 +124251,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -124491,9 +124311,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -124551,9 +124371,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -124611,9 +124431,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -124671,9 +124491,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -124731,9 +124551,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -124791,9 +124611,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -124851,9 +124671,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -124911,9 +124731,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -124971,9 +124791,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -125031,9 +124851,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -125091,9 +124911,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -125151,9 +124971,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -125211,9 +125031,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -125271,9 +125091,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -125331,9 +125151,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -125391,9 +125211,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -125451,9 +125271,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -125511,9 +125331,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -125571,9 +125391,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -125631,9 +125451,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -125691,9 +125511,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -125751,9 +125571,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -125811,9 +125631,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -125871,9 +125691,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -125931,9 +125751,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -125991,9 +125811,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -126051,9 +125871,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -126111,9 +125931,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -126171,9 +125991,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -126231,9 +126051,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -126291,9 +126111,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -126351,9 +126171,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -126411,9 +126231,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -126471,9 +126291,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -126531,9 +126351,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -126591,9 +126411,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -126651,9 +126471,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -126711,9 +126531,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -126771,9 +126591,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -126831,9 +126651,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -126891,9 +126711,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -126951,9 +126771,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -127011,9 +126831,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -127071,9 +126891,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -127131,9 +126951,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -127191,9 +127011,69 @@ }, { "techniqueID": "T1562.001", + "score": -2, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + }, + { + "techniqueID": "T1518.001", + "score": 12, + "showSubtechniques": false + }, + { + "techniqueID": "T1113", + "score": 11, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1087.002", + "score": 12, + "showSubtechniques": false + }, + { + "techniqueID": "T1063", + "score": 12, + "showSubtechniques": false + }, + { + "techniqueID": "T1190", + "score": 11, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" + }, + { + "techniqueID": "T1555", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml" + }, + { + "techniqueID": "T1036", "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": false + }, + { + "techniqueID": "T1136.002", + "score": 12, + "showSubtechniques": false + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": false + }, + { + "techniqueID": "T1562.001", + "score": -2, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -127251,9 +127131,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -127311,9 +127191,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -127371,9 +127251,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -127431,9 +127311,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -127491,9 +127371,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -127551,9 +127431,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -127611,9 +127491,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -127671,9 +127551,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -127731,9 +127611,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -127791,9 +127671,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -127851,9 +127731,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -127911,9 +127791,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -127971,9 +127851,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -128031,9 +127911,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -128091,9 +127971,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -128151,9 +128031,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -128211,9 +128091,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -128271,9 +128151,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -128331,9 +128211,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -128391,9 +128271,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -128451,9 +128331,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -128511,9 +128391,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -128571,9 +128451,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -128631,9 +128511,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -128691,9 +128571,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -128751,9 +128631,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -128811,9 +128691,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -128871,9 +128751,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -128931,9 +128811,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -128991,9 +128871,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -129051,9 +128931,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -129111,9 +128991,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -129171,9 +129051,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -129231,9 +129111,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -129291,9 +129171,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -129351,9 +129231,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -129411,9 +129291,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -129471,9 +129351,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -129531,9 +129411,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -129591,9 +129471,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -129651,9 +129531,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -129711,9 +129591,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -129771,9 +129651,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -129831,9 +129711,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -129891,9 +129771,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -129951,9 +129831,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -130011,9 +129891,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -130071,9 +129951,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -130131,9 +130011,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -130191,9 +130071,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -130251,9 +130131,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -130311,9 +130191,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -130371,9 +130251,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -130431,9 +130311,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -130491,9 +130371,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -130551,9 +130431,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -130611,9 +130491,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -130671,9 +130551,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -130731,9 +130611,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -130791,9 +130671,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -130851,9 +130731,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -130911,9 +130791,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -130971,9 +130851,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -131031,9 +130911,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -131091,9 +130971,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -131151,9 +131031,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -131211,9 +131091,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -131271,9 +131151,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -131331,9 +131211,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -131391,9 +131271,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -131451,9 +131331,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -131511,9 +131391,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -131571,9 +131451,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -131631,9 +131511,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -131691,9 +131571,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -131751,9 +131631,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -131811,9 +131691,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -131871,9 +131751,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -131931,9 +131811,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -131991,9 +131871,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -132051,9 +131931,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -132111,9 +131991,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -132171,9 +132051,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -132231,9 +132111,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -132291,9 +132171,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -132351,9 +132231,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -132411,9 +132291,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -132471,9 +132351,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -132531,9 +132411,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -132591,9 +132471,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -132651,9 +132531,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -132711,9 +132591,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -132771,9 +132651,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -132831,9 +132711,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -132891,9 +132771,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -132951,9 +132831,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -133011,9 +132891,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -133071,9 +132951,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -133131,9 +133011,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -133191,9 +133071,69 @@ }, { "techniqueID": "T1562.001", + "score": -2, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + }, + { + "techniqueID": "T1518.001", + "score": 12, + "showSubtechniques": false + }, + { + "techniqueID": "T1113", + "score": 11, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1087.002", + "score": 12, + "showSubtechniques": false + }, + { + "techniqueID": "T1063", + "score": 12, + "showSubtechniques": false + }, + { + "techniqueID": "T1190", + "score": 11, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" + }, + { + "techniqueID": "T1555", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml" + }, + { + "techniqueID": "T1036", "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": false + }, + { + "techniqueID": "T1136.002", + "score": 12, + "showSubtechniques": false + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": false + }, + { + "techniqueID": "T1562.001", + "score": -2, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -133251,9 +133191,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -133311,9 +133251,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -133371,9 +133311,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -133431,9 +133371,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -133491,9 +133431,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -133551,9 +133491,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -133611,9 +133551,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -133671,9 +133611,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -133731,9 +133671,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -133791,9 +133731,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -133851,9 +133791,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -133911,9 +133851,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -133971,9 +133911,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -134031,9 +133971,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -134091,9 +134031,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -134151,9 +134091,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -134211,9 +134151,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -134271,9 +134211,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -134331,9 +134271,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -134391,9 +134331,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -134451,9 +134391,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -134511,9 +134451,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -134571,9 +134511,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -134631,9 +134571,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -134691,9 +134631,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -134751,9 +134691,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -134811,9 +134751,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -134821,48 +134761,63 @@ "showSubtechniques": false }, { - "techniqueID": "T1571", + "techniqueID": "T1113", "score": 11, - "showSubtechniques": false + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, { - "techniqueID": "T1073", - "score": 11, + "techniqueID": "T1087.002", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1574.002", - "score": 11, + "techniqueID": "T1063", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1571", + "techniqueID": "T1190", "score": 11, - "showSubtechniques": false + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { - "techniqueID": "T1073", - "score": 11, - "showSubtechniques": false + "techniqueID": "T1555", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml" }, { - "techniqueID": "T1574.002", - "score": 11, + "techniqueID": "T1036", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" + }, + { + "techniqueID": "T1560", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1571", - "score": 11, + "techniqueID": "T1136.002", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1073", - "score": 11, + "techniqueID": "T1041", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1574.002", - "score": 11, + "techniqueID": "T1562.001", + "score": -2, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + }, + { + "techniqueID": "T1518.001", + "score": 12, "showSubtechniques": false }, { @@ -140101,163 +140056,48 @@ "showSubtechniques": false }, { - "techniqueID": "T1119", - "score": 10, - "showSubtechniques": false - }, - { - "techniqueID": "T1505.003", - "score": 8, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" - }, - { - "techniqueID": "T1100", - "score": 10, - "showSubtechniques": false - }, - { - "techniqueID": "T1119", - "score": 10, - "showSubtechniques": false - }, - { - "techniqueID": "T1505.003", - "score": 8, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" - }, - { - "techniqueID": "T1100", - "score": 10, - "showSubtechniques": false - }, - { - "techniqueID": "T1119", - "score": 10, - "showSubtechniques": false - }, - { - "techniqueID": "T1505.003", - "score": 8, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" - }, - { - "techniqueID": "T1100", - "score": 10, - "showSubtechniques": false - }, - { - "techniqueID": "T1119", - "score": 10, - "showSubtechniques": false - }, - { - "techniqueID": "T1505.003", - "score": 8, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" - }, - { - "techniqueID": "T1100", - "score": 10, - "showSubtechniques": false - }, - { - "techniqueID": "T1119", - "score": 10, - "showSubtechniques": false - }, - { - "techniqueID": "T1505.003", - "score": 8, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" - }, - { - "techniqueID": "T1100", - "score": 10, - "showSubtechniques": false - }, - { - "techniqueID": "T1119", - "score": 10, - "showSubtechniques": false - }, - { - "techniqueID": "T1505.003", - "score": 8, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" - }, - { - "techniqueID": "T1100", - "score": 10, + "techniqueID": "T1571", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1119", - "score": 10, + "techniqueID": "T1073", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1505.003", - "score": 8, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" - }, - { - "techniqueID": "T1100", - "score": 10, + "techniqueID": "T1574.002", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1119", - "score": 10, + "techniqueID": "T1571", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1505.003", - "score": 8, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" - }, - { - "techniqueID": "T1100", - "score": 10, + "techniqueID": "T1073", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1119", - "score": 10, + "techniqueID": "T1574.002", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1505.003", - "score": 8, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" - }, - { - "techniqueID": "T1100", - "score": 10, + "techniqueID": "T1571", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1119", - "score": 10, + "techniqueID": "T1073", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1505.003", - "score": 8, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" - }, - { - "techniqueID": "T1100", - "score": 10, + "techniqueID": "T1574.002", + "score": 11, "showSubtechniques": false }, { @@ -145733,259 +145573,163 @@ "showSubtechniques": false }, { - "techniqueID": "T1143", - "score": 9, - "showSubtechniques": false - }, - { - "techniqueID": "T1559.002", - "score": 9, - "showSubtechniques": false - }, - { - "techniqueID": "T1135", - "score": 6, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1090.002", - "score": 9, - "showSubtechniques": false - }, - { - "techniqueID": "T1036.004", - "score": 9, + "techniqueID": "T1119", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1110", + "techniqueID": "T1505.003", "score": 8, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" - }, - { - "techniqueID": "T1068", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1102.002", - "score": 9, - "showSubtechniques": false + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { - "techniqueID": "T1564.003", - "score": 9, + "techniqueID": "T1100", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1173", - "score": 9, + "techniqueID": "T1119", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1569.002", + "techniqueID": "T1505.003", "score": 8, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" - }, - { - "techniqueID": "T1035", - "score": 9, - "showSubtechniques": false - }, - { - "techniqueID": "T1143", - "score": 9, - "showSubtechniques": false - }, - { - "techniqueID": "T1559.002", - "score": 9, - "showSubtechniques": false - }, - { - "techniqueID": "T1135", - "score": 6, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { - "techniqueID": "T1090.002", - "score": 9, + "techniqueID": "T1100", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1036.004", - "score": 9, + "techniqueID": "T1119", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1110", + "techniqueID": "T1505.003", "score": 8, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" - }, - { - "techniqueID": "T1068", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1102.002", - "score": 9, - "showSubtechniques": false + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { - "techniqueID": "T1564.003", - "score": 9, + "techniqueID": "T1100", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1173", - "score": 9, + "techniqueID": "T1119", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1569.002", + "techniqueID": "T1505.003", "score": 8, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" - }, - { - "techniqueID": "T1035", - "score": 9, - "showSubtechniques": false + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { - "techniqueID": "T1143", - "score": 9, + "techniqueID": "T1100", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1559.002", - "score": 9, + "techniqueID": "T1119", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1135", - "score": 6, + "techniqueID": "T1505.003", + "score": 8, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { - "techniqueID": "T1090.002", - "score": 9, + "techniqueID": "T1100", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1036.004", - "score": 9, + "techniqueID": "T1119", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1110", + "techniqueID": "T1505.003", "score": 8, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" - }, - { - "techniqueID": "T1068", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1102.002", - "score": 9, - "showSubtechniques": false + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { - "techniqueID": "T1564.003", - "score": 9, + "techniqueID": "T1100", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1173", - "score": 9, + "techniqueID": "T1119", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1569.002", + "techniqueID": "T1505.003", "score": 8, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" - }, - { - "techniqueID": "T1035", - "score": 9, - "showSubtechniques": false + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { - "techniqueID": "T1143", - "score": 9, + "techniqueID": "T1100", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1559.002", - "score": 9, + "techniqueID": "T1119", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1135", - "score": 6, + "techniqueID": "T1505.003", + "score": 8, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { - "techniqueID": "T1090.002", - "score": 9, + "techniqueID": "T1100", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1036.004", - "score": 9, + "techniqueID": "T1119", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1110", + "techniqueID": "T1505.003", "score": 8, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" - }, - { - "techniqueID": "T1068", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1102.002", - "score": 9, - "showSubtechniques": false + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { - "techniqueID": "T1564.003", - "score": 9, + "techniqueID": "T1100", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1173", - "score": 9, + "techniqueID": "T1119", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1569.002", + "techniqueID": "T1505.003", "score": 8, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { - "techniqueID": "T1035", - "score": 9, + "techniqueID": "T1100", + "score": 10, "showSubtechniques": false }, { @@ -146043,9 +145787,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -146107,9 +145851,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -146171,9 +145915,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -146235,9 +145979,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -146299,9 +146043,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -146363,9 +146107,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -146427,9 +146171,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -146491,9 +146235,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -146555,9 +146299,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -146619,9 +146363,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -146683,9 +146427,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -146747,9 +146491,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -146811,9 +146555,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -146875,9 +146619,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -146939,9 +146683,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -147003,9 +146747,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -147067,9 +146811,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -147131,9 +146875,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -147195,9 +146939,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -147259,9 +147003,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -147323,9 +147067,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -147387,9 +147131,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -147451,9 +147195,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -147515,9 +147259,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -147579,9 +147323,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -147643,9 +147387,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -147707,9 +147451,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -147771,9 +147515,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -147835,9 +147579,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -147899,9 +147643,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -147963,9 +147707,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -148027,9 +147771,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -148091,9 +147835,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -148155,9 +147899,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -148219,9 +147963,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -148283,9 +148027,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -148347,9 +148091,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -148411,9 +148155,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -148475,9 +148219,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -148539,9 +148283,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -148603,9 +148347,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -148667,9 +148411,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -148731,9 +148475,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -148795,9 +148539,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -148859,9 +148603,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -148923,9 +148667,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -148987,9 +148731,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -149051,9 +148795,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -149115,9 +148859,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -149179,9 +148923,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -149243,9 +148987,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -149307,9 +149051,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -149371,9 +149115,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -149435,9 +149179,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -149499,9 +149243,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -149563,9 +149307,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -149627,9 +149371,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -149691,9 +149435,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -149755,9 +149499,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -149819,9 +149563,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -149883,9 +149627,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -149947,9 +149691,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -150011,9 +149755,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -150075,9 +149819,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -150139,9 +149883,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -150203,9 +149947,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -150267,9 +150011,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -150331,9 +150075,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -150395,9 +150139,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -150459,9 +150203,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -150523,9 +150267,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -150587,9 +150331,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -150651,9 +150395,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -150715,9 +150459,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -150779,9 +150523,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -150843,9 +150587,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -150907,9 +150651,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -150971,9 +150715,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -151035,9 +150779,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -151099,9 +150843,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -151163,9 +150907,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -151227,9 +150971,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -151291,9 +151035,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -151355,9 +151099,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -151419,9 +151163,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -151483,9 +151227,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -151547,9 +151291,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -151611,9 +151355,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -151675,9 +151419,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -151739,9 +151483,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -151803,9 +151547,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -151867,9 +151611,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -151931,9 +151675,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -151995,9 +151739,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -152059,9 +151803,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -152123,9 +151867,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -152187,9 +151931,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -152251,9 +151995,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -152315,9 +152059,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -152379,9 +152123,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -152443,9 +152187,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -152507,9 +152251,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -152571,9 +152315,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -152635,9 +152379,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -152699,9 +152443,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -152763,9 +152507,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -152827,9 +152571,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -152891,9 +152635,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -152955,9 +152699,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -153019,9 +152763,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -153083,9 +152827,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -153147,9 +152891,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -153211,9 +152955,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -153275,9 +153019,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -153339,9 +153083,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -153403,9 +153147,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -153467,9 +153211,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -153531,9 +153275,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -153595,9 +153339,73 @@ }, { "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" + }, + { + "techniqueID": "T1035", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1135", + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1036.004", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1110", "score": 8, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" + }, + { + "techniqueID": "T1068", + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1102.002", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -153659,9 +153467,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -153723,9 +153531,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -153787,9 +153595,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -153851,9 +153659,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -153915,9 +153723,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -153979,9 +153787,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -154043,9 +153851,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -154107,9 +153915,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -154171,9 +153979,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -154235,9 +154043,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -154299,9 +154107,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -154363,9 +154171,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -154427,9 +154235,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -154491,9 +154299,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -154555,9 +154363,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -154619,9 +154427,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -154683,9 +154491,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -154747,9 +154555,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -154811,9 +154619,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -154875,9 +154683,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -154939,9 +154747,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -155003,9 +154811,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -155067,9 +154875,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -155131,9 +154939,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -155195,9 +155003,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -155259,9 +155067,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -155323,9 +155131,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -155387,9 +155195,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -155451,9 +155259,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -155515,9 +155323,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -155579,9 +155387,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -155643,9 +155451,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -155707,9 +155515,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -155771,9 +155579,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -155835,9 +155643,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -155899,9 +155707,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -155963,9 +155771,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -156027,9 +155835,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -156091,9 +155899,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -156155,9 +155963,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -156219,9 +156027,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -156283,9 +156091,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -156347,9 +156155,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -156411,9 +156219,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -156475,9 +156283,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -156539,9 +156347,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -156603,9 +156411,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -156667,9 +156475,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -156731,9 +156539,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -156795,9 +156603,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -156859,9 +156667,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -156923,9 +156731,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -156987,9 +156795,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -157051,9 +156859,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -157115,9 +156923,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -157179,9 +156987,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -157243,9 +157051,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -157307,9 +157115,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -157371,9 +157179,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -157435,9 +157243,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -157499,9 +157307,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -157563,9 +157371,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -157627,9 +157435,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -157691,9 +157499,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -157755,9 +157563,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -157819,9 +157627,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -157883,9 +157691,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -157947,9 +157755,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -158011,9 +157819,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -158075,9 +157883,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -158139,9 +157947,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -158203,9 +158011,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -158267,9 +158075,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -158331,9 +158139,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -158395,9 +158203,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -158459,9 +158267,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -158523,9 +158331,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -158587,9 +158395,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -158651,9 +158459,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -158715,9 +158523,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -158779,9 +158587,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -158843,9 +158651,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -158907,9 +158715,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -158971,9 +158779,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -159035,9 +158843,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -159099,9 +158907,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -159163,9 +158971,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -159227,9 +159035,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -159291,9 +159099,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -159355,9 +159163,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -159419,9 +159227,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -159483,9 +159291,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -159547,9 +159355,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -159611,9 +159419,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -159675,9 +159483,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -159739,9 +159547,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -159803,9 +159611,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -159867,9 +159675,73 @@ }, { "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" + }, + { + "techniqueID": "T1035", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1135", + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1036.004", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1110", "score": 8, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" + }, + { + "techniqueID": "T1068", + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1102.002", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -159931,9 +159803,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -159995,9 +159867,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -160059,9 +159931,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -160123,9 +159995,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -160187,9 +160059,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -160251,9 +160123,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -160315,9 +160187,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -160379,9 +160251,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -160443,9 +160315,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -160507,9 +160379,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -160571,9 +160443,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -160635,9 +160507,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -160699,9 +160571,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -160763,9 +160635,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -160827,9 +160699,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -160891,9 +160763,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -160955,9 +160827,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -161019,9 +160891,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -161083,9 +160955,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -161147,9 +161019,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -161211,9 +161083,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -161275,9 +161147,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -161339,9 +161211,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -161403,9 +161275,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -161467,9 +161339,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -161531,9 +161403,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -161595,9 +161467,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -161659,9 +161531,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -161723,9 +161595,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -161787,9 +161659,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -161851,9 +161723,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -161915,9 +161787,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -161979,9 +161851,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -162043,9 +161915,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -162107,9 +161979,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -162171,9 +162043,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -162235,9 +162107,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -162299,9 +162171,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -162363,9 +162235,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -162427,9 +162299,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -162491,9 +162363,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -162555,9 +162427,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -162619,9 +162491,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -162683,9 +162555,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -162747,9 +162619,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -162811,9 +162683,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -162875,9 +162747,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -162939,9 +162811,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -163003,9 +162875,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -163067,9 +162939,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -163131,9 +163003,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -163195,9 +163067,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -163259,9 +163131,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -163323,9 +163195,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -163387,9 +163259,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -163451,9 +163323,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -163515,9 +163387,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -163579,9 +163451,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -163643,9 +163515,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -163707,9 +163579,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -163771,9 +163643,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -163835,9 +163707,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -163899,9 +163771,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -163963,9 +163835,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -164027,9 +163899,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -164091,9 +163963,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -164155,9 +164027,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -164219,9 +164091,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -164283,9 +164155,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -164347,9 +164219,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -164411,9 +164283,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -164475,9 +164347,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -164539,9 +164411,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -164603,9 +164475,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -164667,9 +164539,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -164731,9 +164603,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -164795,9 +164667,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -164859,9 +164731,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -164923,9 +164795,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -164987,9 +164859,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -165051,9 +164923,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -165115,9 +164987,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -165179,9 +165051,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -165243,9 +165115,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -165307,9 +165179,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -165371,9 +165243,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -165435,9 +165307,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -165499,9 +165371,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -165563,9 +165435,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -165627,9 +165499,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -165691,9 +165563,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -165755,9 +165627,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -165819,9 +165691,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -165883,9 +165755,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -165947,9 +165819,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -166011,9 +165883,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -166075,9 +165947,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -166139,9 +166011,73 @@ }, { "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" + }, + { + "techniqueID": "T1035", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1135", + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1036.004", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1110", "score": 8, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" + }, + { + "techniqueID": "T1068", + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1102.002", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -166203,9 +166139,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -166267,9 +166203,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -166331,9 +166267,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -166395,9 +166331,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -166459,9 +166395,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -166523,9 +166459,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -166587,9 +166523,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -166651,9 +166587,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -166715,9 +166651,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -166779,9 +166715,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -166843,9 +166779,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -166907,9 +166843,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -166971,9 +166907,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -167035,9 +166971,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -167099,9 +167035,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -167163,9 +167099,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -167227,9 +167163,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -167291,9 +167227,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -167355,9 +167291,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -167419,9 +167355,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -167483,9 +167419,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -167547,9 +167483,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -167611,9 +167547,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -167675,9 +167611,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -167739,9 +167675,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -167803,9 +167739,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -167867,9 +167803,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -167931,9 +167867,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -167995,9 +167931,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -168059,9 +167995,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -168123,9 +168059,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -168187,9 +168123,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -168251,9 +168187,73 @@ }, { "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" + }, + { + "techniqueID": "T1035", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1135", + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1036.004", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1110", "score": 8, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" + }, + { + "techniqueID": "T1068", + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1102.002", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -269724,9 +269724,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -269827,9 +269827,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -269930,9 +269930,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -270033,9 +270033,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -270136,9 +270136,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -270239,9 +270239,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -270342,9 +270342,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -270445,9 +270445,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -270548,9 +270548,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -270651,9 +270651,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -270754,9 +270754,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -270857,9 +270857,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -270960,9 +270960,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -271063,9 +271063,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -271166,9 +271166,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -271269,9 +271269,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -271372,9 +271372,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -271475,9 +271475,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -271578,9 +271578,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -271681,9 +271681,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -271784,9 +271784,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -271887,9 +271887,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -271990,9 +271990,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -272093,9 +272093,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -272196,9 +272196,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -272299,9 +272299,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -272402,9 +272402,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -272505,9 +272505,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -272608,9 +272608,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -272711,9 +272711,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -272814,9 +272814,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -272917,9 +272917,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -273020,9 +273020,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -273123,9 +273123,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -273226,9 +273226,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -273329,9 +273329,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -273432,9 +273432,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -273535,9 +273535,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -273638,9 +273638,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -273741,9 +273741,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -273844,9 +273844,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -273947,9 +273947,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -274050,9 +274050,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -274153,9 +274153,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -274256,9 +274256,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -274359,9 +274359,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -274462,9 +274462,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -274565,9 +274565,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -274668,9 +274668,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -274771,9 +274771,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -274874,9 +274874,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -274977,9 +274977,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -275080,9 +275080,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -275183,9 +275183,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -275286,9 +275286,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -275389,9 +275389,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -275492,9 +275492,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -275595,9 +275595,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -275698,9 +275698,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -275801,9 +275801,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -275904,9 +275904,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -276007,9 +276007,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -276110,9 +276110,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -276213,9 +276213,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -276316,9 +276316,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -276419,9 +276419,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -276522,9 +276522,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -276625,9 +276625,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -276728,9 +276728,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -276831,9 +276831,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -276934,9 +276934,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -277037,9 +277037,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -277140,9 +277140,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -277243,9 +277243,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -277346,9 +277346,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -277449,9 +277449,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -277552,9 +277552,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -277655,9 +277655,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -277758,9 +277758,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -277861,9 +277861,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -277964,9 +277964,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -278067,9 +278067,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -278170,9 +278170,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -278273,9 +278273,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -278376,9 +278376,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -278479,9 +278479,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -278582,9 +278582,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -278685,9 +278685,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -278788,9 +278788,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -278891,9 +278891,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -278994,9 +278994,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -279097,9 +279097,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -279200,9 +279200,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -279303,9 +279303,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -279406,9 +279406,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -279509,9 +279509,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -279612,9 +279612,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -279715,9 +279715,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -279818,9 +279818,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -279921,9 +279921,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -280024,9 +280024,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -280127,9 +280127,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -280230,9 +280230,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -280333,9 +280333,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -280436,9 +280436,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -280539,9 +280539,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -280642,9 +280642,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -280745,9 +280745,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -280848,9 +280848,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -280951,9 +280951,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -281054,9 +281054,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -281157,9 +281157,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -281260,9 +281260,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -281363,9 +281363,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -281466,9 +281466,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -281569,9 +281569,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -281672,9 +281672,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -281775,9 +281775,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -281878,9 +281878,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -281981,9 +281981,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -282084,9 +282084,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -282187,9 +282187,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -282290,9 +282290,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -282393,9 +282393,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -282496,9 +282496,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -282599,9 +282599,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -282702,9 +282702,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -282805,9 +282805,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -282908,9 +282908,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -283011,9 +283011,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -283114,9 +283114,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -283217,9 +283217,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -283320,9 +283320,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -283423,9 +283423,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -283526,9 +283526,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -283629,9 +283629,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -283732,9 +283732,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -283835,9 +283835,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -283938,9 +283938,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -284041,9 +284041,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -284144,9 +284144,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -284247,9 +284247,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -284350,9 +284350,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -284453,9 +284453,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -284556,9 +284556,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -284659,9 +284659,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -284762,9 +284762,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -284865,9 +284865,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -284968,9 +284968,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -285071,9 +285071,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -285174,9 +285174,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -285277,9 +285277,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -285380,9 +285380,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -285483,9 +285483,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -285586,9 +285586,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -285689,9 +285689,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -285792,9 +285792,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -285895,9 +285895,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -285998,9 +285998,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -286101,9 +286101,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -286204,9 +286204,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -286307,9 +286307,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -286410,9 +286410,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -286513,9 +286513,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -286616,9 +286616,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -286719,9 +286719,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -286822,9 +286822,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -286925,9 +286925,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -287028,9 +287028,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -287131,9 +287131,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -287234,9 +287234,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -287337,9 +287337,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -287440,9 +287440,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -287543,9 +287543,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -287646,9 +287646,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -287749,9 +287749,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -287852,9 +287852,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -287955,9 +287955,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -288058,9 +288058,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -288161,9 +288161,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -288264,9 +288264,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -288367,9 +288367,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -288470,9 +288470,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -288573,9 +288573,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -288676,9 +288676,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -288779,9 +288779,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -288882,9 +288882,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -288985,9 +288985,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -289088,9 +289088,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -289191,9 +289191,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -289294,9 +289294,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -289397,9 +289397,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -289500,9 +289500,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -289603,9 +289603,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -289706,9 +289706,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -289809,9 +289809,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -289912,9 +289912,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -290015,9 +290015,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -290118,9 +290118,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -290221,9 +290221,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -290324,9 +290324,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -290427,9 +290427,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -290530,9 +290530,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -290633,9 +290633,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -290736,9 +290736,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -290839,9 +290839,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -290942,9 +290942,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -291045,9 +291045,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -291148,9 +291148,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -291251,9 +291251,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -291354,9 +291354,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -291457,9 +291457,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -291560,9 +291560,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -291663,9 +291663,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -291766,9 +291766,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -291869,9 +291869,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -291972,9 +291972,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -292075,9 +292075,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -292178,9 +292178,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -292281,9 +292281,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -292384,9 +292384,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -292487,9 +292487,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -292590,9 +292590,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -292693,9 +292693,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -292796,9 +292796,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -292899,9 +292899,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -293002,9 +293002,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -293105,9 +293105,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -293208,9 +293208,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -293311,9 +293311,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -293414,9 +293414,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -293517,9 +293517,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -293620,9 +293620,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -293723,9 +293723,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -293826,9 +293826,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -293929,9 +293929,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -294032,9 +294032,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -294135,9 +294135,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -294238,9 +294238,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -294341,9 +294341,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -294444,9 +294444,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -294547,9 +294547,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -294650,9 +294650,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -294753,9 +294753,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -294856,9 +294856,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -294959,9 +294959,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -295062,9 +295062,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -295165,9 +295165,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -295268,9 +295268,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -295371,9 +295371,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -295474,9 +295474,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -295577,9 +295577,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -295680,9 +295680,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -295783,9 +295783,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -295886,9 +295886,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -295989,9 +295989,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -296092,9 +296092,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -296195,9 +296195,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -296298,9 +296298,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -296401,9 +296401,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -296504,9 +296504,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -296607,9 +296607,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -296710,9 +296710,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -296813,9 +296813,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -296916,9 +296916,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -297019,9 +297019,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -297122,9 +297122,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -297225,9 +297225,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -297328,9 +297328,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -297431,9 +297431,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -297534,9 +297534,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -297637,9 +297637,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -297740,9 +297740,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -297843,9 +297843,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -297946,9 +297946,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -298049,9 +298049,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -298152,9 +298152,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -298255,9 +298255,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -298358,9 +298358,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -298461,9 +298461,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -298564,9 +298564,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -298667,9 +298667,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -298770,9 +298770,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -298873,9 +298873,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -298976,9 +298976,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -299079,9 +299079,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -299182,9 +299182,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -299285,9 +299285,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -299388,9 +299388,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -299491,9 +299491,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -299594,9 +299594,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -299697,9 +299697,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -299800,9 +299800,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -299903,9 +299903,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -300006,9 +300006,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -300109,9 +300109,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -300212,9 +300212,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -300315,9 +300315,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -300418,9 +300418,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -300521,9 +300521,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -300624,9 +300624,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -300727,9 +300727,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -300830,9 +300830,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -300933,9 +300933,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -301036,9 +301036,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -301139,9 +301139,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -301242,9 +301242,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -301345,9 +301345,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -301448,9 +301448,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -301551,9 +301551,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -301654,9 +301654,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -301757,9 +301757,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -301860,9 +301860,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -301963,9 +301963,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -302066,9 +302066,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -302169,9 +302169,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -302272,9 +302272,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -302375,9 +302375,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -302478,9 +302478,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -302581,9 +302581,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -302684,9 +302684,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -302787,9 +302787,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -302890,9 +302890,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -302993,9 +302993,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -303096,9 +303096,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -303199,9 +303199,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -303302,9 +303302,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -303405,9 +303405,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -303508,9 +303508,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -303611,9 +303611,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -303714,9 +303714,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -303817,9 +303817,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -303920,9 +303920,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -304023,9 +304023,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -304126,9 +304126,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -304229,9 +304229,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -304332,9 +304332,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -304435,9 +304435,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -304538,9 +304538,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -304641,9 +304641,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -304744,9 +304744,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -304847,9 +304847,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -304950,9 +304950,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -305053,9 +305053,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -305156,9 +305156,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -305259,9 +305259,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -305362,9 +305362,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -305465,9 +305465,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -305568,9 +305568,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -305671,9 +305671,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -305774,9 +305774,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -305877,9 +305877,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -305987,7 +305987,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -306126,7 +306126,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -306265,7 +306265,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -306404,7 +306404,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -306543,7 +306543,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -306682,7 +306682,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -306821,7 +306821,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -306960,7 +306960,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -307099,7 +307099,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -307238,7 +307238,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -307377,7 +307377,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -307516,7 +307516,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -307655,7 +307655,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -307794,7 +307794,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -307933,7 +307933,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -308072,7 +308072,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -308211,7 +308211,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -308350,7 +308350,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -308489,7 +308489,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -308628,7 +308628,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -308767,7 +308767,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -308906,7 +308906,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -309045,7 +309045,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -309184,7 +309184,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -309323,7 +309323,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -309462,7 +309462,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -309601,7 +309601,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -309740,7 +309740,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -309879,7 +309879,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -310018,7 +310018,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -310157,7 +310157,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -310296,7 +310296,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -310435,7 +310435,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -310574,7 +310574,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -310713,7 +310713,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -310852,7 +310852,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -310991,7 +310991,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -311130,7 +311130,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -311269,7 +311269,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -311408,7 +311408,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -311547,7 +311547,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -311686,7 +311686,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -311825,7 +311825,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -311964,7 +311964,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -312103,7 +312103,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -312242,7 +312242,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -312381,7 +312381,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -312520,7 +312520,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -312659,7 +312659,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -312798,7 +312798,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -312937,7 +312937,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -313076,7 +313076,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -313215,7 +313215,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -313354,7 +313354,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -313493,7 +313493,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -313632,7 +313632,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -313771,7 +313771,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -313910,7 +313910,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -314049,7 +314049,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -314188,7 +314188,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -314327,7 +314327,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -314466,7 +314466,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -314605,7 +314605,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -314744,7 +314744,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -314883,7 +314883,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -315022,7 +315022,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -315161,7 +315161,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -315300,7 +315300,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -315439,7 +315439,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -315578,7 +315578,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -315717,7 +315717,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -315856,7 +315856,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -315995,7 +315995,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -316134,7 +316134,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -316273,7 +316273,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -316412,7 +316412,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -316551,7 +316551,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -316690,7 +316690,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -316829,7 +316829,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -316968,7 +316968,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -317107,7 +317107,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -317246,7 +317246,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -317385,7 +317385,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -317524,7 +317524,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -317663,7 +317663,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -317802,7 +317802,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -317941,7 +317941,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -318080,7 +318080,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -318219,7 +318219,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -318358,7 +318358,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -318497,7 +318497,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -318636,7 +318636,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -318775,7 +318775,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -318914,7 +318914,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -319053,7 +319053,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -319192,7 +319192,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -319331,7 +319331,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -319470,7 +319470,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -319609,7 +319609,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -319748,7 +319748,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -319887,7 +319887,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -320026,7 +320026,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -320165,7 +320165,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -320304,7 +320304,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -320443,7 +320443,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -320582,7 +320582,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -320721,7 +320721,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -320860,7 +320860,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -320999,7 +320999,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -321138,7 +321138,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -321277,7 +321277,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -321416,7 +321416,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -321555,7 +321555,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -321694,7 +321694,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -321833,7 +321833,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -321972,7 +321972,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -322111,7 +322111,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -322250,7 +322250,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -322389,7 +322389,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -322528,7 +322528,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -322667,7 +322667,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -322806,7 +322806,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -322945,7 +322945,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -323084,7 +323084,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -323223,7 +323223,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -323362,7 +323362,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -323501,7 +323501,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -323640,7 +323640,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -323779,7 +323779,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -323918,7 +323918,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -324057,7 +324057,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -324196,7 +324196,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -324335,7 +324335,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -324474,7 +324474,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -324613,7 +324613,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -324752,7 +324752,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -324891,7 +324891,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -325030,7 +325030,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -325169,7 +325169,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -325308,7 +325308,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -325447,7 +325447,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -325586,7 +325586,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -325725,7 +325725,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -325864,7 +325864,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -326003,7 +326003,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -326142,7 +326142,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -326281,7 +326281,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -326420,7 +326420,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -326559,7 +326559,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -326698,7 +326698,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -326837,7 +326837,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -326976,7 +326976,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -327115,7 +327115,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -327254,7 +327254,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -327393,7 +327393,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -327532,7 +327532,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -327671,7 +327671,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -327810,7 +327810,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -327949,7 +327949,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -328088,7 +328088,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -328227,7 +328227,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -328366,7 +328366,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -328505,7 +328505,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -328644,7 +328644,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -328783,7 +328783,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -328922,7 +328922,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -329061,7 +329061,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -329200,7 +329200,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -329339,7 +329339,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -329478,7 +329478,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -329617,7 +329617,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -329756,7 +329756,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -329895,7 +329895,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -330034,7 +330034,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -330173,7 +330173,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -330312,7 +330312,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -330451,7 +330451,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -330590,7 +330590,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -330729,7 +330729,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -330868,7 +330868,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -331007,7 +331007,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -331146,7 +331146,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -331285,7 +331285,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -331424,7 +331424,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -331563,7 +331563,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -331702,7 +331702,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -331841,7 +331841,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -331980,7 +331980,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -332119,7 +332119,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -332258,7 +332258,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -332397,7 +332397,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -332536,7 +332536,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -332675,7 +332675,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -332814,7 +332814,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -332953,7 +332953,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -333092,7 +333092,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -333231,7 +333231,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -333370,7 +333370,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -333509,7 +333509,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -333648,7 +333648,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -333787,7 +333787,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -333926,7 +333926,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -334065,7 +334065,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -334204,7 +334204,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -334343,7 +334343,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -334482,7 +334482,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -334621,7 +334621,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -334760,7 +334760,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -334899,7 +334899,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -335038,7 +335038,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -335177,7 +335177,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -335316,7 +335316,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -335455,7 +335455,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -335594,7 +335594,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -335733,7 +335733,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -335872,7 +335872,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -336011,7 +336011,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -336150,7 +336150,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -336289,7 +336289,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -336428,7 +336428,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -336567,7 +336567,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -336706,7 +336706,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -336845,7 +336845,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -336984,7 +336984,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -337123,7 +337123,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -337262,7 +337262,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -337401,7 +337401,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -337540,7 +337540,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -337679,7 +337679,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -337818,7 +337818,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -337957,7 +337957,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -338096,7 +338096,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -338235,7 +338235,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -338374,7 +338374,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -338513,7 +338513,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -338652,7 +338652,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -338791,7 +338791,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -338930,7 +338930,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -339069,7 +339069,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -339208,7 +339208,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -339347,7 +339347,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -339486,7 +339486,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -339625,7 +339625,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -339764,7 +339764,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -339903,7 +339903,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -340042,7 +340042,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -340181,7 +340181,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -340320,7 +340320,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -340459,7 +340459,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -340598,7 +340598,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -340737,7 +340737,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -340876,7 +340876,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -341015,7 +341015,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -341154,7 +341154,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -341293,7 +341293,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -341432,7 +341432,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -341571,7 +341571,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -341710,7 +341710,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -341849,7 +341849,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -341988,7 +341988,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -342127,7 +342127,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -342266,7 +342266,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -342405,7 +342405,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -342544,7 +342544,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -342683,7 +342683,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -342822,7 +342822,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -342961,7 +342961,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -343100,7 +343100,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -343239,7 +343239,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -343378,7 +343378,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -343517,7 +343517,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -343656,7 +343656,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -343795,7 +343795,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -343934,7 +343934,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -344073,7 +344073,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -344212,7 +344212,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -344351,7 +344351,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -344490,7 +344490,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -344629,7 +344629,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -344768,7 +344768,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -344907,7 +344907,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -345046,7 +345046,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -345185,7 +345185,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -345324,7 +345324,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -345463,7 +345463,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -345602,7 +345602,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -345741,7 +345741,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -345880,7 +345880,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -346019,7 +346019,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -346158,7 +346158,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -346297,7 +346297,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -346436,7 +346436,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -346575,7 +346575,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -346714,7 +346714,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -346853,7 +346853,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -346992,7 +346992,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -347131,7 +347131,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -347270,7 +347270,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -347409,7 +347409,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -347548,7 +347548,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -347687,7 +347687,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -347826,7 +347826,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -347965,7 +347965,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -348104,7 +348104,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -348243,7 +348243,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -348382,7 +348382,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -348521,7 +348521,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -348660,7 +348660,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -348799,7 +348799,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -348938,7 +348938,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -349077,7 +349077,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -349216,7 +349216,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -349355,7 +349355,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -349494,7 +349494,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -349633,7 +349633,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -349772,7 +349772,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -349911,7 +349911,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -350050,7 +350050,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -350189,7 +350189,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -350328,7 +350328,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -350467,7 +350467,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -350606,7 +350606,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -350745,7 +350745,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -350884,7 +350884,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -351023,7 +351023,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -351162,7 +351162,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -351301,7 +351301,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -351440,7 +351440,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -351579,7 +351579,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -351718,7 +351718,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -351857,7 +351857,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -351996,7 +351996,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -352135,7 +352135,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -352274,7 +352274,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -352413,7 +352413,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -352552,7 +352552,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -352691,7 +352691,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -352830,7 +352830,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -352969,7 +352969,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -353108,7 +353108,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -353247,7 +353247,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -353386,7 +353386,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -353525,7 +353525,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -353664,7 +353664,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -353803,7 +353803,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -353942,7 +353942,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -354081,7 +354081,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -354220,7 +354220,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -354359,7 +354359,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -354498,7 +354498,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -354637,7 +354637,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -354776,7 +354776,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -354961,204 +354961,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1585", - "score": 2, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1500", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1485", "score": 0, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml" - }, - { - "techniqueID": "T1498", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1588.003", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1008", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1053.002", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1090.001", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1584.001", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1529", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1067", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1542.003", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1080", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1587.002", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1091", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1583.001", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1572", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1004", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1071.003", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1021.006", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1547.004", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1550.003", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1188", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1074", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1104", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1583.006", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1072", - "score": 2, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" - }, - { - "techniqueID": "T1210", - "score": 2, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml" - }, - { - "techniqueID": "T1199", - "score": 2, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1069.001", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1097", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1090.003", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1584.006", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1486", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml" - }, - { - "techniqueID": "T1573", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1028", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1027.004", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -355353,8 +355158,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -355549,204 +355355,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1585", - "score": 2, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1500", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1485", "score": 0, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml" - }, - { - "techniqueID": "T1498", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1588.003", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1008", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1053.002", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1090.001", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1584.001", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1529", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1067", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1542.003", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1080", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1587.002", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1091", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1583.001", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1572", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1004", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1071.003", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1021.006", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1547.004", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1550.003", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1188", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1074", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1104", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1583.006", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1072", - "score": 2, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" - }, - { - "techniqueID": "T1210", - "score": 2, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml" - }, - { - "techniqueID": "T1199", - "score": 2, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1069.001", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1097", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1090.003", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1584.006", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1486", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml" - }, - { - "techniqueID": "T1573", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1028", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1027.004", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -355941,204 +355552,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1585", - "score": 2, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1500", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1485", "score": 0, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml" - }, - { - "techniqueID": "T1498", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1588.003", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1008", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1053.002", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1090.001", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1584.001", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1529", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1067", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1542.003", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1080", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1587.002", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1091", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1583.001", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1572", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1004", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1071.003", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1021.006", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1547.004", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1550.003", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1188", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1074", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1104", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1583.006", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1072", - "score": 2, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" - }, - { - "techniqueID": "T1210", - "score": 2, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml" - }, - { - "techniqueID": "T1199", - "score": 2, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1069.001", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1097", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1090.003", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1584.006", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1486", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml" - }, - { - "techniqueID": "T1573", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1028", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1027.004", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -356333,8 +355749,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -356529,8 +355946,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -356725,8 +356143,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -356921,8 +356340,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -357117,8 +356537,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -357313,8 +356734,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -357509,8 +356931,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -357705,8 +357128,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -357901,8 +357325,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -358097,8 +357522,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -358293,8 +357719,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -358489,8 +357916,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -358685,8 +358113,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -358881,8 +358310,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -359077,8 +358507,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -359273,8 +358704,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -359469,8 +358901,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -359665,8 +359098,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -359861,8 +359295,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -360057,9 +359492,207 @@ }, { "techniqueID": "T1197", + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, + { + "techniqueID": "T1585", + "score": 2, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": false + }, + { + "techniqueID": "T1485", + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml" + }, + { + "techniqueID": "T1498", + "score": 3, + "showSubtechniques": false + }, + { + "techniqueID": "T1588.003", + "score": 3, + "showSubtechniques": false + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": false + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": false + }, + { + "techniqueID": "T1090.001", + "score": 3, + "showSubtechniques": false + }, + { + "techniqueID": "T1584.001", + "score": 3, + "showSubtechniques": false + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": false + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": false + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": false + }, + { + "techniqueID": "T1080", + "score": 3, + "showSubtechniques": false + }, + { + "techniqueID": "T1587.002", + "score": 3, + "showSubtechniques": false + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": false + }, + { + "techniqueID": "T1583.001", + "score": 3, + "showSubtechniques": false + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": false + }, + { + "techniqueID": "T1004", + "score": 3, + "showSubtechniques": false + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": false + }, + { + "techniqueID": "T1021.006", + "score": 3, + "showSubtechniques": false + }, + { + "techniqueID": "T1547.004", + "score": 3, + "showSubtechniques": false + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": false + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": false + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": false + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": false + }, + { + "techniqueID": "T1583.006", "score": 3, "showSubtechniques": false }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml" + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": false + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": false + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": false + }, + { + "techniqueID": "T1584.006", + "score": 3, + "showSubtechniques": false + }, + { + "techniqueID": "T1486", + "score": -3, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml" + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": false + }, + { + "techniqueID": "T1028", + "score": 3, + "showSubtechniques": false + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": false + }, + { + "techniqueID": "T1197", + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1585", "score": 2, @@ -360253,8 +359886,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -360449,8 +360083,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -360645,8 +360280,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -360841,8 +360477,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -361037,8 +360674,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -361233,8 +360871,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -361429,8 +361068,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -361625,8 +361265,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -361821,8 +361462,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -362017,8 +361659,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -362213,8 +361856,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -362409,8 +362053,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -362605,8 +362250,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -362801,8 +362447,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -362997,8 +362644,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -363193,8 +362841,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -363389,8 +363038,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -363585,8 +363235,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -363781,8 +363432,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -363977,8 +363629,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -364173,8 +363826,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -364369,8 +364023,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -364565,8 +364220,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -364761,8 +364417,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -364957,8 +364614,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -365153,8 +364811,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -365349,8 +365008,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -365545,8 +365205,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -365741,8 +365402,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -365937,8 +365599,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -366133,8 +365796,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -366329,8 +365993,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -366525,8 +366190,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -366721,8 +366387,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -366917,8 +366584,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -367113,8 +366781,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -367309,8 +366978,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -367505,8 +367175,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -367701,8 +367372,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -367897,8 +367569,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -368093,8 +367766,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -368289,8 +367963,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -368485,8 +368160,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -368681,8 +368357,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -368877,8 +368554,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -369073,8 +368751,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -369269,8 +368948,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -369465,8 +369145,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -369661,8 +369342,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -369857,8 +369539,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -370053,8 +369736,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -370249,8 +369933,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -370445,8 +370130,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -370641,8 +370327,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -370837,8 +370524,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -371033,8 +370721,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -371229,8 +370918,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -371425,8 +371115,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -371621,8 +371312,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -371817,8 +371509,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -372013,8 +371706,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -372209,8 +371903,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -372405,8 +372100,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -372601,8 +372297,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -372797,8 +372494,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -372993,8 +372691,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -373189,8 +372888,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -373385,8 +373085,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -373581,8 +373282,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -373777,8 +373479,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -373973,8 +373676,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -374169,8 +373873,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -374365,8 +374070,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -374561,8 +374267,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -374757,8 +374464,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -374953,8 +374661,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -375149,8 +374858,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -375345,8 +375055,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -375541,8 +375252,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -375737,8 +375449,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -375933,8 +375646,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -376129,8 +375843,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -376325,8 +376040,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -376521,8 +376237,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -376717,8 +376434,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -376913,8 +376631,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -377109,8 +376828,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -377305,8 +377025,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -377501,8 +377222,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -377697,8 +377419,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -377893,8 +377616,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -378089,8 +377813,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -378285,8 +378010,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -378481,8 +378207,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -378677,8 +378404,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -378873,8 +378601,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -379069,8 +378798,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -379265,8 +378995,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -379461,8 +379192,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -379657,8 +379389,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -379853,8 +379586,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -380049,8 +379783,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -380245,8 +379980,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -380441,8 +380177,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -380637,8 +380374,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -380833,8 +380571,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -381029,8 +380768,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -381225,8 +380965,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -381421,8 +381162,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -381617,8 +381359,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -381813,8 +381556,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -382009,8 +381753,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -382205,8 +381950,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -382401,8 +382147,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -382597,8 +382344,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -382793,8 +382541,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -382989,8 +382738,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -383185,8 +382935,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -383381,8 +383132,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -383577,8 +383329,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -383773,8 +383526,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -383969,8 +383723,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -384165,8 +383920,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -384361,8 +384117,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -384557,8 +384314,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -384753,8 +384511,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -384949,8 +384708,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -385145,8 +384905,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -385341,8 +385102,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -385537,8 +385299,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -385733,8 +385496,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -385929,8 +385693,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -386125,8 +385890,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -386321,8 +386087,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -386517,8 +386284,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -386713,8 +386481,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -386909,8 +386678,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -387105,8 +386875,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -387301,8 +387072,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -387497,8 +387269,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -387693,8 +387466,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -387889,8 +387663,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -388085,8 +387860,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -388281,8 +388057,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -388477,8 +388254,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -388673,8 +388451,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -388869,8 +388648,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -389065,8 +388845,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -389261,8 +389042,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -389457,8 +389239,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -389653,8 +389436,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -389849,8 +389633,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -390045,8 +389830,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -390241,8 +390027,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -390437,8 +390224,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -390633,8 +390421,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -390829,8 +390618,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -391025,8 +390815,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -391221,8 +391012,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -391417,8 +391209,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -391613,8 +391406,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -391809,8 +391603,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -392005,8 +391800,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -392201,8 +391997,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -392397,8 +392194,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -392593,8 +392391,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -392789,8 +392588,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -392985,8 +392785,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -393181,8 +392982,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -393377,8 +393179,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -393573,8 +393376,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -393769,8 +393573,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -393965,8 +393770,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -394161,8 +393967,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -394357,8 +394164,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -394553,8 +394361,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -394749,8 +394558,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -394945,8 +394755,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -395141,8 +394952,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -395337,8 +395149,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -395533,8 +395346,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -395729,8 +395543,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -395925,8 +395740,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -396121,8 +395937,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -396317,8 +396134,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -396513,8 +396331,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -396709,8 +396528,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -396905,8 +396725,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -397101,8 +396922,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -397297,8 +397119,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -397493,8 +397316,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -397689,8 +397513,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -397885,8 +397710,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -398081,8 +397907,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -398277,8 +398104,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -398473,8 +398301,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -398669,8 +398498,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -398865,8 +398695,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -399061,8 +398892,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -399257,8 +399089,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -399453,8 +399286,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -399649,8 +399483,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -399845,8 +399680,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -400041,8 +399877,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -400237,8 +400074,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -400433,8 +400271,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -400629,8 +400468,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -400825,8 +400665,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -401021,8 +400862,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -401217,8 +401059,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -401413,8 +401256,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -401609,8 +401453,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -401805,8 +401650,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -402001,8 +401847,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -402197,8 +402044,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -402393,8 +402241,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -402589,8 +402438,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -402785,8 +402635,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -402981,8 +402832,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -403177,8 +403029,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -403373,8 +403226,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -403569,8 +403423,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -403765,8 +403620,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -403961,8 +403817,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -404157,8 +404014,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -404353,8 +404211,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -404549,8 +404408,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -404745,8 +404605,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -404941,8 +404802,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -405137,8 +404999,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -405333,8 +405196,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -405529,8 +405393,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -405725,8 +405590,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -405921,8 +405787,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -406117,8 +405984,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -406313,8 +406181,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -406509,8 +406378,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -406705,8 +406575,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -406901,8 +406772,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -407097,8 +406969,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -407293,8 +407166,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -407489,8 +407363,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -407685,8 +407560,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -407881,8 +407757,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -408077,8 +407954,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -408273,8 +408151,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -408469,8 +408348,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -408665,8 +408545,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -408861,8 +408742,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -409057,8 +408939,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -409253,8 +409136,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -409449,8 +409333,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -409645,8 +409530,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -409841,8 +409727,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -410037,8 +409924,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -410233,8 +410121,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -410429,8 +410318,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -410625,8 +410515,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -410821,8 +410712,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -411017,8 +410909,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -411213,8 +411106,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -411409,8 +411303,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -411605,8 +411500,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -411801,8 +411697,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -411997,8 +411894,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -412193,8 +412091,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -412389,8 +412288,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -412585,8 +412485,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -412781,8 +412682,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -412977,8 +412879,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -413173,8 +413076,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -413369,8 +413273,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -413565,8 +413470,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -413761,8 +413667,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -413957,8 +413864,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -414153,8 +414061,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -414349,8 +414258,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -414545,8 +414455,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -414741,8 +414652,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -414937,8 +414849,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -415133,8 +415046,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -415329,8 +415243,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -415525,8 +415440,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -415721,8 +415637,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -415917,8 +415834,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -416113,8 +416031,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -416309,8 +416228,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -416505,8 +416425,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -416701,8 +416622,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -416897,8 +416819,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -417093,8 +417016,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -417289,8 +417213,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -417485,8 +417410,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -417681,8 +417607,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -417877,8 +417804,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -418073,8 +418001,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -418269,8 +418198,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -418465,8 +418395,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -418661,8 +418592,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -418857,8 +418789,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -419053,8 +418986,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -419249,8 +419183,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -419445,8 +419380,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -419641,8 +419577,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -419837,8 +419774,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -420033,8 +419971,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -420229,8 +420168,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -420425,8 +420365,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -420621,8 +420562,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -420817,8 +420759,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -421013,8 +420956,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -421209,8 +421153,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -421405,8 +421350,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -421601,8 +421547,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -421797,8 +421744,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -421993,8 +421941,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -422189,8 +422138,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -422385,8 +422335,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -422581,8 +422532,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -422777,8 +422729,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -422973,8 +422926,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -423169,8 +423123,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -423365,8 +423320,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -423561,8 +423517,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -423757,8 +423714,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -423813,443 +423771,399 @@ "showSubtechniques": false }, { - "techniqueID": "T1596.003", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1222.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1492", - "score": 2, + "techniqueID": "T1067", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1213.002", - "score": 2, + "techniqueID": "T1542.003", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1109", - "score": 2, + "techniqueID": "T1080", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1588.004", - "score": 2, + "techniqueID": "T1587.002", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1587.003", - "score": 2, + "techniqueID": "T1091", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1565.001", - "score": 2, + "techniqueID": "T1583.001", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1114.001", - "score": 2, + "techniqueID": "T1572", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1489", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml" - }, - { - "techniqueID": "T1568.001", - "score": 2, + "techniqueID": "T1004", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1559.001", - "score": 2, + "techniqueID": "T1071.003", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1115", - "score": 2, + "techniqueID": "T1021.006", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1218.007", - "score": 2, + "techniqueID": "T1547.004", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1176", - "score": 2, + "techniqueID": "T1550.003", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1584.003", - "score": 2, + "techniqueID": "T1188", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1560.002", - "score": 2, + "techniqueID": "T1074", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1032", - "score": 2, + "techniqueID": "T1104", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1087.003", - "score": 2, + "techniqueID": "T1583.006", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1218.003", + "techniqueID": "T1072", "score": 2, - "showSubtechniques": false + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { - "techniqueID": "T1562.002", + "techniqueID": "T1210", "score": 2, - "showSubtechniques": false + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml" }, { - "techniqueID": "T1145", + "techniqueID": "T1199", "score": 2, - "showSubtechniques": false + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { - "techniqueID": "T1552.004", - "score": 2, + "techniqueID": "T1069.001", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1583.004", - "score": 2, + "techniqueID": "T1097", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1134.002", - "score": 2, + "techniqueID": "T1090.003", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1125", - "score": 2, + "techniqueID": "T1584.006", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1482", - "score": 0, + "techniqueID": "T1486", + "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1542.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1583.003", - "score": 2, - "showSubtechniques": false + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml" }, { - "techniqueID": "T1191", - "score": 2, + "techniqueID": "T1573", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1055.002", - "score": 2, + "techniqueID": "T1028", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1059.004", - "score": 2, + "techniqueID": "T1027.004", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1208", - "score": 2, - "showSubtechniques": false + "techniqueID": "T1197", + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { - "techniqueID": "T1036.001", + "techniqueID": "T1585", "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1201", - "score": 1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml" }, { - "techniqueID": "T1187", - "score": 2, + "techniqueID": "T1500", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1567.002", - "score": 2, - "showSubtechniques": false + "techniqueID": "T1485", + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml" }, { - "techniqueID": "T1564.005", - "score": 2, + "techniqueID": "T1498", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1584.004", - "score": 2, + "techniqueID": "T1588.003", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1098.002", - "score": 2, + "techniqueID": "T1008", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1037.001", - "score": 2, + "techniqueID": "T1053.002", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1480.001", - "score": 2, + "techniqueID": "T1090.001", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1558.003", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml" - }, - { - "techniqueID": "T1596.003", - "score": 2, + "techniqueID": "T1584.001", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1222.002", - "score": 2, + "techniqueID": "T1529", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1492", - "score": 2, + "techniqueID": "T1067", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1213.002", - "score": 2, + "techniqueID": "T1542.003", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1109", - "score": 2, + "techniqueID": "T1080", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1588.004", - "score": 2, + "techniqueID": "T1587.002", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1587.003", - "score": 2, + "techniqueID": "T1091", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1565.001", - "score": 2, + "techniqueID": "T1583.001", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1114.001", - "score": 2, + "techniqueID": "T1572", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1489", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml" - }, - { - "techniqueID": "T1568.001", - "score": 2, + "techniqueID": "T1004", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1559.001", - "score": 2, + "techniqueID": "T1071.003", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1115", - "score": 2, + "techniqueID": "T1021.006", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1218.007", - "score": 2, + "techniqueID": "T1547.004", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1176", - "score": 2, + "techniqueID": "T1550.003", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1584.003", - "score": 2, + "techniqueID": "T1188", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1560.002", - "score": 2, + "techniqueID": "T1074", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1032", - "score": 2, + "techniqueID": "T1104", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1087.003", - "score": 2, + "techniqueID": "T1583.006", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1218.003", + "techniqueID": "T1072", "score": 2, - "showSubtechniques": false + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { - "techniqueID": "T1562.002", + "techniqueID": "T1210", "score": 2, - "showSubtechniques": false + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml" }, { - "techniqueID": "T1145", + "techniqueID": "T1199", "score": 2, - "showSubtechniques": false + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { - "techniqueID": "T1552.004", - "score": 2, + "techniqueID": "T1069.001", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1583.004", - "score": 2, + "techniqueID": "T1097", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1134.002", - "score": 2, + "techniqueID": "T1090.003", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1125", - "score": 2, + "techniqueID": "T1584.006", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1482", - "score": 0, + "techniqueID": "T1486", + "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1542.002", - "score": 2, - "showSubtechniques": false + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml" }, { - "techniqueID": "T1583.003", - "score": 2, + "techniqueID": "T1573", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1191", - "score": 2, + "techniqueID": "T1028", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1055.002", - "score": 2, + "techniqueID": "T1027.004", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1059.004", - "score": 2, - "showSubtechniques": false + "techniqueID": "T1197", + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { - "techniqueID": "T1208", + "techniqueID": "T1585", "score": 2, - "showSubtechniques": false + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml" }, { - "techniqueID": "T1036.001", - "score": 2, + "techniqueID": "T1500", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1201", - "score": 1, + "techniqueID": "T1485", + "score": 0, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml" }, { - "techniqueID": "T1187", - "score": 2, + "techniqueID": "T1498", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1567.002", - "score": 2, + "techniqueID": "T1588.003", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1564.005", - "score": 2, + "techniqueID": "T1008", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1584.004", - "score": 2, + "techniqueID": "T1053.002", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1098.002", - "score": 2, + "techniqueID": "T1090.001", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1037.001", - "score": 2, + "techniqueID": "T1584.001", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1480.001", - "score": 2, + "techniqueID": "T1529", + "score": 3, "showSubtechniques": false }, - { - "techniqueID": "T1558.003", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml" - }, { "techniqueID": "T1596.003", "score": 2, @@ -424383,9 +424297,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -424602,9 +424516,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -424821,9 +424735,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -425040,9 +424954,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -425259,9 +425173,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -425478,9 +425392,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -425697,9 +425611,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -425916,9 +425830,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -426135,9 +426049,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -426354,9 +426268,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -426573,9 +426487,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -426792,9 +426706,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -427011,9 +426925,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -427230,9 +427144,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -427449,9 +427363,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -427668,9 +427582,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -427887,9 +427801,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -428106,9 +428020,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -428325,9 +428239,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -428544,9 +428458,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -428763,9 +428677,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -428982,9 +428896,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -429201,9 +429115,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -429420,9 +429334,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -429639,9 +429553,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -429858,9 +429772,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -430077,9 +429991,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -430296,9 +430210,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -430515,9 +430429,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -430734,9 +430648,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -430953,9 +430867,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -431172,9 +431086,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -431391,9 +431305,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -431610,9 +431524,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -431829,9 +431743,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -432048,9 +431962,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -432267,9 +432181,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -432486,9 +432400,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -432705,9 +432619,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -432924,9 +432838,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -433143,9 +433057,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -433362,9 +433276,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -433581,9 +433495,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -433800,9 +433714,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -434019,9 +433933,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -434238,9 +434152,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -434457,9 +434371,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -434676,9 +434590,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -434895,9 +434809,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -435114,9 +435028,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -435333,9 +435247,228 @@ }, { "techniqueID": "T1482", + "score": -1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1583.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1208", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1036.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1201", + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml" + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1584.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1098.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1558.003", "score": 0, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml" + }, + { + "techniqueID": "T1596.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1588.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1587.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1114.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml" + }, + { + "techniqueID": "T1568.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1584.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1562.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1145", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1552.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1583.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1482", + "score": -1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -435552,9 +435685,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -435771,9 +435904,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -435990,9 +436123,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -436209,9 +436342,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -436428,9 +436561,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -436647,9 +436780,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -436866,9 +436999,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -437085,9 +437218,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -437304,9 +437437,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -437523,9 +437656,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -437742,9 +437875,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -437961,9 +438094,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -438180,9 +438313,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -438399,9 +438532,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -438618,9 +438751,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -438837,9 +438970,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -439056,9 +439189,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -439275,9 +439408,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -439494,9 +439627,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -439713,9 +439846,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -439932,9 +440065,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -440151,9 +440284,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -440370,9 +440503,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -440589,9 +440722,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -440808,9 +440941,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -441027,9 +441160,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -441246,9 +441379,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -441465,9 +441598,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -441684,9 +441817,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -441903,9 +442036,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -442122,9 +442255,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -442341,9 +442474,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -442560,9 +442693,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -442779,9 +442912,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -442998,9 +443131,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -443217,9 +443350,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -443436,9 +443569,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -443655,9 +443788,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -443874,9 +444007,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -444093,9 +444226,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -444312,9 +444445,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -444531,9 +444664,228 @@ }, { "techniqueID": "T1482", + "score": -1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1583.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1208", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1036.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1201", + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml" + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1584.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1098.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1558.003", "score": 0, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml" + }, + { + "techniqueID": "T1596.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1588.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1587.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1114.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml" + }, + { + "techniqueID": "T1568.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1584.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1562.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1145", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1552.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1583.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1482", + "score": -1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -444750,9 +445102,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -444969,9 +445321,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -445188,9 +445540,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -445407,9 +445759,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -445626,9 +445978,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -445845,9 +446197,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -446064,9 +446416,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -446283,9 +446635,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -446502,9 +446854,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -446721,9 +447073,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -446940,9 +447292,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -447159,9 +447511,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -447378,9 +447730,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -447597,9 +447949,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -447816,9 +448168,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -448035,9 +448387,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -448254,9 +448606,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -448473,9 +448825,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -448692,9 +449044,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -448911,9 +449263,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -449130,9 +449482,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -449349,9 +449701,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -449568,9 +449920,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -449787,9 +450139,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -450006,9 +450358,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -450225,9 +450577,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -450444,9 +450796,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -450663,9 +451015,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -450882,9 +451234,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -451101,9 +451453,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -451320,9 +451672,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -451539,9 +451891,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -451758,9 +452110,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -451977,9 +452329,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -452196,9 +452548,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -452415,9 +452767,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -452634,9 +452986,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -452853,9 +453205,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -453072,9 +453424,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -453291,9 +453643,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -453510,9 +453862,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -453729,9 +454081,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -453948,9 +454300,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -454167,9 +454519,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -454386,9 +454738,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -454605,9 +454957,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -454824,9 +455176,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -455043,9 +455395,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -455262,9 +455614,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -455481,9 +455833,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -455700,9 +456052,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -455919,9 +456271,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -456138,9 +456490,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -456357,9 +456709,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -456576,9 +456928,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -456795,9 +457147,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -457014,9 +457366,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -457233,9 +457585,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -457452,9 +457804,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -457671,9 +458023,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -457890,9 +458242,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -458109,9 +458461,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -458328,9 +458680,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -458547,9 +458899,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -458766,9 +459118,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -458985,9 +459337,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -459204,9 +459556,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -459423,9 +459775,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -459642,9 +459994,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -459861,9 +460213,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -460080,9 +460432,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -460299,9 +460651,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -460518,9 +460870,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -460737,9 +461089,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -460956,9 +461308,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -461175,9 +461527,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -461394,9 +461746,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -461613,9 +461965,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -461832,9 +462184,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -462051,9 +462403,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -462270,9 +462622,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -462489,9 +462841,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -462708,9 +463060,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -462927,9 +463279,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -463146,9 +463498,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -463365,9 +463717,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -463584,9 +463936,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -463803,9 +464155,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -464022,9 +464374,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -464241,9 +464593,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -464460,9 +464812,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -464679,9 +465031,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -464898,9 +465250,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -465117,9 +465469,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -465336,9 +465688,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -465555,9 +465907,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -465774,9 +466126,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -465993,9 +466345,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -466212,9 +466564,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -466431,9 +466783,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -466650,9 +467002,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -466869,9 +467221,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -467088,9 +467440,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -467307,9 +467659,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -467526,9 +467878,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -467745,9 +468097,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -467964,9 +468316,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -468183,9 +468535,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -468402,9 +468754,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -468621,9 +468973,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -468840,9 +469192,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -469059,9 +469411,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -469278,9 +469630,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -469497,9 +469849,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -469716,9 +470068,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -469935,9 +470287,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -470154,9 +470506,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -470373,9 +470725,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -470592,9 +470944,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -470811,9 +471163,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -471030,9 +471382,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -471249,9 +471601,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -471468,9 +471820,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -471687,9 +472039,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -471906,9 +472258,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -472125,9 +472477,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -472344,9 +472696,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -472563,9 +472915,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -472782,9 +473134,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -473001,9 +473353,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -473220,9 +473572,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -473439,9 +473791,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -473658,9 +474010,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -473877,9 +474229,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -474096,9 +474448,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -474315,9 +474667,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -474534,9 +474886,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -474753,9 +475105,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -474972,9 +475324,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -475191,9 +475543,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -475410,9 +475762,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -475629,9 +475981,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -475848,9 +476200,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -476067,9 +476419,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -476286,9 +476638,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -476505,9 +476857,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -476724,9 +477076,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -476943,9 +477295,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -477162,9 +477514,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -477381,9 +477733,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -477600,9 +477952,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -477819,9 +478171,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -478038,9 +478390,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -478257,9 +478609,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -478476,9 +478828,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -478695,9 +479047,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -478914,9 +479266,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -479133,9 +479485,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -479352,9 +479704,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -479571,9 +479923,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -479790,9 +480142,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -480009,9 +480361,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -480228,9 +480580,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -480447,9 +480799,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -480666,9 +481018,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -480885,9 +481237,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -481104,9 +481456,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -481323,9 +481675,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -481542,9 +481894,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -481761,9 +482113,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -481980,9 +482332,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -482199,9 +482551,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -482418,9 +482770,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -482637,9 +482989,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -482856,9 +483208,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -483075,9 +483427,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -483294,9 +483646,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -483513,9 +483865,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -483732,9 +484084,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -483951,9 +484303,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -484170,9 +484522,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -484389,9 +484741,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -484608,9 +484960,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -484827,9 +485179,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -485046,9 +485398,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -485265,9 +485617,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -485484,9 +485836,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -485703,9 +486055,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -485922,9 +486274,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -486141,9 +486493,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -486360,9 +486712,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -486579,9 +486931,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -486798,9 +487150,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -487017,9 +487369,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -487236,9 +487588,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -487455,9 +487807,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -487674,9 +488026,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -487893,9 +488245,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -488112,9 +488464,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -488331,9 +488683,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -488550,9 +488902,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -488769,9 +489121,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -488988,9 +489340,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -489207,9 +489559,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -489426,9 +489778,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -489645,9 +489997,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -489864,9 +490216,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -490083,9 +490435,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -490302,9 +490654,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -490521,9 +490873,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -490740,9 +491092,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -490959,9 +491311,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -491178,9 +491530,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -491397,9 +491749,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -491616,9 +491968,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -491835,9 +492187,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -492054,9 +492406,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -492273,9 +492625,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -492492,9 +492844,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -492711,9 +493063,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -492930,9 +493282,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -493149,9 +493501,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -493368,9 +493720,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -493587,9 +493939,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -493806,9 +494158,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -494025,9 +494377,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -494244,9 +494596,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -494463,9 +494815,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -494682,9 +495034,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -494901,9 +495253,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -495120,9 +495472,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -495339,9 +495691,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -495558,9 +495910,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -495777,9 +496129,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -495996,9 +496348,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -496215,9 +496567,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -496434,9 +496786,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -496653,9 +497005,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -496872,9 +497224,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -497091,9 +497443,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -497310,9 +497662,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -497529,9 +497881,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -497748,9 +498100,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -497967,9 +498319,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -498186,9 +498538,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -498405,9 +498757,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -498624,9 +498976,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -498843,9 +499195,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -499062,9 +499414,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -499281,9 +499633,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -499500,9 +499852,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -499719,9 +500071,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -499938,9 +500290,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -500157,9 +500509,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -500376,9 +500728,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -500595,9 +500947,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -500814,9 +501166,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", diff --git a/docs/stories.md b/docs/stories.md index 6a9447404c..7b2dded0d1 100644 --- a/docs/stories.md +++ b/docs/stories.md @@ -284,6 +284,50 @@ _version_: 1
details +### BITS Jobs +Adversaries may abuse BITS jobs to persistently execute or clean up after malicious payloads. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Endpoint +- **ATT&CK**: [T1105](https://attack.mitre.org/techniques/T1105/), [T1197](https://attack.mitre.org/techniques/T1197/) +- **Last Updated**: 2021-03-26 + +
+ details + +#### Detection Profile + +* [BITS Job Persistence](detections.md#bits-job-persistence) + +* [BITSAdmin Download File](detections.md#bitsadmin-download-file) + +* [PowerShell Start-BitsTransfer](detections.md#powershell-start-bitstransfer) + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------| +| T1197 | BITS Jobs | Defense Evasion, Persistence | +| T1105 | Ingress Tool Transfer | Command and Control | + +#### Kill Chain Phase + +* Exploitation + + +#### Reference + +* https://attack.mitre.org/techniques/T1197/ + +* https://docs.microsoft.com/en-us/windows/win32/bits/bitsadmin-tool + + +_version_: 1 +
+ +--- + ### Baron Samedit CVE-2021-3156 Uncover activity consistent with CVE-2021-3156. Discovered by the Qualys Research Team, this vulnerability has been found to affect sudo across multiple Linux distributions (Ubuntu 20.04 and prior, Debian 10 and prior, Fedora 33 and prior). As this vulnerability was committed to code in July 2011, there will be many distributions affected. Successful exploitation of this vulnerability allows any unprivileged user to gain root privileges on the vulnerable host. @@ -924,6 +968,48 @@ _version_: 2 --- +### Domain Trust Discovery +Adversaries may attempt to gather information on domain trust relationships that may be used to identify lateral movement opportunities in Windows multi-domain/forest environments. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Endpoint +- **ATT&CK**: [T1018](https://attack.mitre.org/techniques/T1018/), [T1482](https://attack.mitre.org/techniques/T1482/) +- **Last Updated**: 2021-03-25 + +
+ details + +#### Detection Profile + +* [DSQuery Domain Discovery](detections.md#dsquery-domain-discovery) + +* [NLTest Domain Trust Discovery](detections.md#nltest-domain-trust-discovery) + +* [Windows AdFind Exe](detections.md#windows-adfind-exe) + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------| +| T1482 | Domain Trust Discovery | Discovery | +| T1018 | Remote System Discovery | Discovery | + +#### Kill Chain Phase + +* Exploitation + + +#### Reference + +* https://attack.mitre.org/techniques/T1482/ + + +_version_: 1 +
+ +--- + ### F5 TMUI RCE CVE-2020-5902 Uncover activity consistent with CVE-2020-5902. Discovered by Positive Technologies researchers, this vulnerability affects F5 BIG-IP, BIG-IQ. and Traffix SDC devices (vulnerable versions in F5 support link below). This vulnerability allows unauthenticated users, along with authenticated users, who have access to the configuration utility to execute system commands, create/delete files, disable services, and/or execute Java code. This vulnerability can result in full system compromise. @@ -1054,7 +1140,7 @@ Adversaries may transfer tools or other files from an external system into a com - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: Endpoint -- **ATT&CK**: [T1105](https://attack.mitre.org/techniques/T1105/) +- **ATT&CK**: [T1059.001](https://attack.mitre.org/techniques/T1059.001/), [T1105](https://attack.mitre.org/techniques/T1105/), [T1197](https://attack.mitre.org/techniques/T1197/) - **Last Updated**: 2021-03-24
@@ -1062,6 +1148,12 @@ Adversaries may transfer tools or other files from an external system into a com #### Detection Profile +* [Any Powershell DownloadFile](detections.md#any-powershell-downloadfile) + +* [Any Powershell DownloadString](detections.md#any-powershell-downloadstring) + +* [BITSAdmin Download File](detections.md#bitsadmin-download-file) + * [CertUtil Download With URLCache and Split Arguments](detections.md#certutil-download-with-urlcache-and-split-arguments) * [CertUtil Download With VerifyCtl and Split Arguments](detections.md#certutil-download-with-verifyctl-and-split-arguments) @@ -1073,7 +1165,21 @@ Adversaries may transfer tools or other files from an external system into a com | ID | Technique | Tactic | | ----------- | ----------- |--------------| +| T1059.001 | PowerShell | Execution | +| T1197 | BITS Jobs | Defense Evasion, Persistence | | T1105 | Ingress Tool Transfer | Command and Control | +| T1003 | OS Credential Dumping | Credential Access | +| T1021 | Remote Services | Lateral Movement | +| T1113 | Screen Capture | Collection | +| T1123 | Audio Capture | Collection | +| T1563 | Remote Service Session Hijacking | Lateral Movement | +| T1053 | Scheduled Task/Job | Execution, Persistence, Privilege Escalation | +| T1134 | Access Token Manipulation | Defense Evasion, Privilege Escalation | +| T1548 | Abuse Elevation Control Mechanism | Defense Evasion, Privilege Escalation | +| T1055 | Process Injection | Defense Evasion, Privilege Escalation | +| T1106 | Native API | Execution | +| T1569 | System Services | Execution | +| T1027 | Obfuscated Files or Information | Defense Evasion | #### Kill Chain Phase @@ -1189,6 +1295,8 @@ Attackers are finding stealthy ways "live off the land," leveraging utilities an | ID | Technique | Tactic | | ----------- | ----------- |--------------| | T1059.001 | PowerShell | Execution | +| T1197 | BITS Jobs | Defense Evasion, Persistence | +| T1105 | Ingress Tool Transfer | Command and Control | | T1003 | OS Credential Dumping | Credential Access | | T1021 | Remote Services | Lateral Movement | | T1113 | Screen Capture | Collection | @@ -2042,16 +2150,12 @@ Monitor and detect registry changes initiated from remote locations, which can b | ID | Technique | Tactic | | ----------- | ----------- |--------------| | T1548.002 | Bypass User Account Control | Defense Evasion, Privilege Escalation | -| T1112 | Modify Registry | Defense Evasion | -| T1222.001 | Windows File and Directory Permissions Modification | Defense Evasion | | T1547.010 | Port Monitors | Persistence, Privilege Escalation | | T1564.001 | Hidden Files and Directories | Defense Evasion | | T1547.001 | Registry Run Keys / Startup Folder | Persistence, Privilege Escalation | | T1546.012 | Image File Execution Options Injection | Persistence, Privilege Escalation | | T1546.011 | Application Shimming | Persistence, Privilege Escalation | | T1546.001 | Change Default File Association | Persistence, Privilege Escalation | -| T1036 | Masquerading | Defense Evasion | -| T1562.001 | Disable or Modify Tools | Defense Evasion | #### Kill Chain Phase @@ -2267,8 +2371,30 @@ Detect tactics used by malware to evade defenses on Windows endpoints. A few of #### Detection Profile +* [Disable Registry Tool](detections.md#disable-registry-tool) + +* [Disable Show Hidden Files](detections.md#disable-show-hidden-files) + +* [Disable Windows Behavior Monitoring](detections.md#disable-windows-behavior-monitoring) + +* [Disable Windows SmartScreen Protection](detections.md#disable-windows-smartscreen-protection) + +* [Disabling CMD Application](detections.md#disabling-cmd-application) + +* [Disabling ControlPanel](detections.md#disabling-controlpanel) + +* [Disabling Firewall with Netsh](detections.md#disabling-firewall-with-netsh) + +* [Disabling FolderOptions Windows Feature](detections.md#disabling-folderoptions-windows-feature) + +* [Disabling NoRun Windows App](detections.md#disabling-norun-windows-app) + * [Disabling Remote User Account Control](detections.md#disabling-remote-user-account-control) +* [Disabling SystemRestore In Registry](detections.md#disabling-systemrestore-in-registry) + +* [Disabling Task Manager](detections.md#disabling-task-manager) + * [Eventvwr UAC Bypass](detections.md#eventvwr-uac-bypass) * [FodHelper UAC Bypass](detections.md#fodhelper-uac-bypass) @@ -2290,17 +2416,12 @@ Detect tactics used by malware to evade defenses on Windows endpoints. A few of | ID | Technique | Tactic | | ----------- | ----------- |--------------| +| T1562.001 | Disable or Modify Tools | Defense Evasion | +| T1564.001 | Hidden Files and Directories | Defense Evasion | | T1548.002 | Bypass User Account Control | Defense Evasion, Privilege Escalation | | T1112 | Modify Registry | Defense Evasion | | T1222.001 | Windows File and Directory Permissions Modification | Defense Evasion | -| T1547.010 | Port Monitors | Persistence, Privilege Escalation | -| T1564.001 | Hidden Files and Directories | Defense Evasion | -| T1547.001 | Registry Run Keys / Startup Folder | Persistence, Privilege Escalation | -| T1546.012 | Image File Execution Options Injection | Persistence, Privilege Escalation | -| T1546.011 | Application Shimming | Persistence, Privilege Escalation | -| T1546.001 | Change Default File Association | Persistence, Privilege Escalation | | T1036 | Masquerading | Defense Evasion | -| T1562.001 | Disable or Modify Tools | Defense Evasion | #### Kill Chain Phase @@ -3222,7 +3343,7 @@ Detect and investigate dormant user accounts for your AWS environment that have - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: -- **ATT&CK**: [T1078.004](https://attack.mitre.org/techniques/T1078.004/) +- **ATT&CK**: [T1078.004](https://attack.mitre.org/techniques/T1078.004/), [T1526](https://attack.mitre.org/techniques/T1526/) - **Last Updated**: 2018-03-12
@@ -3230,6 +3351,8 @@ Detect and investigate dormant user accounts for your AWS environment that have #### Detection Profile +* [AWS Excessive Security Scanning](detections.md#aws-excessive-security-scanning) + * [Detect API activity from users without MFA](detections.md#detect-api-activity-from-users-without-mfa) * [Detect AWS API Activities From Unapproved Accounts](detections.md#detect-aws-api-activities-from-unapproved-accounts) @@ -3245,6 +3368,7 @@ Detect and investigate dormant user accounts for your AWS environment that have | ID | Technique | Tactic | | ----------- | ----------- |--------------| +| T1526 | Cloud Service Discovery | Discovery | | T1078.004 | Cloud Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation | #### Kill Chain Phase @@ -3990,7 +4114,7 @@ _version_: 1 ### Suspicious Cloud User Activities Detect and investigate suspicious activities by users and roles in your cloud environments. -- **Product**: Splunk Security Analytics for AWS, Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Product**: Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: Change - **ATT&CK**: [T1078](https://attack.mitre.org/techniques/T1078/), [T1078.004](https://attack.mitre.org/techniques/T1078.004/) - **Last Updated**: 2020-09-04 diff --git a/docs/stories.wiki b/docs/stories.wiki index 6df32b70ff..f38a7080ba 100644 --- a/docs/stories.wiki +++ b/docs/stories.wiki @@ -346,6 +346,61 @@ Monitor your environment for activity consistent with common attack techniques b ==Adversary Tactics== +===Bits jobs=== +Adversaries may abuse BITS jobs to persistently execute or clean up after malicious payloads. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1197/ T1197], [https://attack.mitre.org/techniques/T1105/ T1105] +* '''Last Updated''': 2021-03-26 + +
+
+ +====Detection Profile==== + +* [[Documentation:ESSOC:detections:Detections#Bits_job_persistence|BITS Job Persistence]] + +* [[Documentation:ESSOC:detections:Detections#Bitsadmin_download_file|BITSAdmin Download File]] + +* [[Documentation:ESSOC:detections:Detections#Powershell_start-bitstransfer|PowerShell Start-BitsTransfer]] + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1197 +| BITS Jobs +| Defense Evasion, Persistence +|- +| T1105 +| Ingress Tool Transfer +| Command and Control +|} + + +====Kill Chain Phase==== + +* Exploitation + + +====Reference==== + +* https://attack.mitre.org/techniques/T1197/ + +* https://docs.microsoft.com/en-us/windows/win32/bits/bitsadmin-tool + + +''version'': 1 +
+
+ +---- + ===Baron samedit cve-2021-3156=== Uncover activity consistent with CVE-2021-3156. Discovered by the Qualys Research Team, this vulnerability has been found to affect sudo across multiple Linux distributions (Ubuntu 20.04 and prior, Debian 10 and prior, Fedora 33 and prior). As this vulnerability was committed to code in July 2011, there will be many distributions affected. Successful exploitation of this vulnerability allows any unprivileged user to gain root privileges on the vulnerable host. @@ -1203,6 +1258,59 @@ Looks for activities and techniques associated with the disabling of security to ---- +===Domain trust discovery=== +Adversaries may attempt to gather information on domain trust relationships that may be used to identify lateral movement opportunities in Windows multi-domain/forest environments. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1482/ T1482], [https://attack.mitre.org/techniques/T1018/ T1018] +* '''Last Updated''': 2021-03-25 + +
+
+ +====Detection Profile==== + +* [[Documentation:ESSOC:detections:Detections#Dsquery_domain_discovery|DSQuery Domain Discovery]] + +* [[Documentation:ESSOC:detections:Detections#Nltest_domain_trust_discovery|NLTest Domain Trust Discovery]] + +* [[Documentation:ESSOC:detections:Detections#Windows_adfind_exe|Windows AdFind Exe]] + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1482 +| Domain Trust Discovery +| Discovery +|- +| T1018 +| Remote System Discovery +| Discovery +|} + + +====Kill Chain Phase==== + +* Exploitation + + +====Reference==== + +* https://attack.mitre.org/techniques/T1482/ + + +''version'': 1 +
+
+ +---- + ===F5 tmui rce cve-2020-5902=== Uncover activity consistent with CVE-2020-5902. Discovered by Positive Technologies researchers, this vulnerability affects F5 BIG-IP, BIG-IQ. and Traffix SDC devices (vulnerable versions in F5 support link below). This vulnerability allows unauthenticated users, along with authenticated users, who have access to the configuration utility to execute system commands, create/delete files, disable services, and/or execute Java code. This vulnerability can result in full system compromise. @@ -1370,7 +1478,7 @@ Adversaries may transfer tools or other files from an external system into a com * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1105/ T1105] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1059.001/ T1059.001], [https://attack.mitre.org/techniques/T1197/ T1197], [https://attack.mitre.org/techniques/T1105/ T1105], [https://attack.mitre.org/techniques/T1003/ T1003], [https://attack.mitre.org/techniques/T1021/ T1021], [https://attack.mitre.org/techniques/T1113/ T1113], [https://attack.mitre.org/techniques/T1123/ T1123], [https://attack.mitre.org/techniques/T1563/ T1563], [https://attack.mitre.org/techniques/T1053/ T1053], [https://attack.mitre.org/techniques/T1134/ T1134], [https://attack.mitre.org/techniques/T1548/ T1548], [https://attack.mitre.org/techniques/T1055/ T1055], [https://attack.mitre.org/techniques/T1106/ T1106], [https://attack.mitre.org/techniques/T1569/ T1569], [https://attack.mitre.org/techniques/T1027/ T1027] * '''Last Updated''': 2021-03-24
@@ -1378,6 +1486,12 @@ Adversaries may transfer tools or other files from an external system into a com ====Detection Profile==== +* [[Documentation:ESSOC:detections:Detections#Any_powershell_downloadfile|Any Powershell DownloadFile]] + +* [[Documentation:ESSOC:detections:Detections#Any_powershell_downloadstring|Any Powershell DownloadString]] + +* [[Documentation:ESSOC:detections:Detections#Bitsadmin_download_file|BITSAdmin Download File]] + * [[Documentation:ESSOC:detections:Detections#Certutil_download_with_urlcache_and_split_arguments|CertUtil Download With URLCache and Split Arguments]] * [[Documentation:ESSOC:detections:Detections#Certutil_download_with_verifyctl_and_split_arguments|CertUtil Download With VerifyCtl and Split Arguments]] @@ -1392,9 +1506,65 @@ Adversaries may transfer tools or other files from an external system into a com ! Technique ! Tactic |- +| T1059.001 +| PowerShell +| Execution +|- +| T1197 +| BITS Jobs +| Defense Evasion, Persistence +|- | T1105 | Ingress Tool Transfer | Command and Control +|- +| T1003 +| OS Credential Dumping +| Credential Access +|- +| T1021 +| Remote Services +| Lateral Movement +|- +| T1113 +| Screen Capture +| Collection +|- +| T1123 +| Audio Capture +| Collection +|- +| T1563 +| Remote Service Session Hijacking +| Lateral Movement +|- +| T1053 +| Scheduled Task/Job +| Execution, Persistence, Privilege Escalation +|- +| T1134 +| Access Token Manipulation +| Defense Evasion, Privilege Escalation +|- +| T1548 +| Abuse Elevation Control Mechanism +| Defense Evasion, Privilege Escalation +|- +| T1055 +| Process Injection +| Defense Evasion, Privilege Escalation +|- +| T1106 +| Native API +| Execution +|- +| T1569 +| System Services +| Execution +|- +| T1027 +| Obfuscated Files or Information +| Defense Evasion |} @@ -1488,7 +1658,7 @@ Attackers are finding stealthy ways "live off the land," leveraging utilities an * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1059.001/ T1059.001], [https://attack.mitre.org/techniques/T1003/ T1003], [https://attack.mitre.org/techniques/T1021/ T1021], [https://attack.mitre.org/techniques/T1113/ T1113], [https://attack.mitre.org/techniques/T1123/ T1123], [https://attack.mitre.org/techniques/T1563/ T1563], [https://attack.mitre.org/techniques/T1053/ T1053], [https://attack.mitre.org/techniques/T1134/ T1134], [https://attack.mitre.org/techniques/T1548/ T1548], [https://attack.mitre.org/techniques/T1055/ T1055], [https://attack.mitre.org/techniques/T1106/ T1106], [https://attack.mitre.org/techniques/T1569/ T1569], [https://attack.mitre.org/techniques/T1027/ T1027] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1059.001/ T1059.001], [https://attack.mitre.org/techniques/T1197/ T1197], [https://attack.mitre.org/techniques/T1105/ T1105], [https://attack.mitre.org/techniques/T1003/ T1003], [https://attack.mitre.org/techniques/T1021/ T1021], [https://attack.mitre.org/techniques/T1113/ T1113], [https://attack.mitre.org/techniques/T1123/ T1123], [https://attack.mitre.org/techniques/T1563/ T1563], [https://attack.mitre.org/techniques/T1053/ T1053], [https://attack.mitre.org/techniques/T1134/ T1134], [https://attack.mitre.org/techniques/T1548/ T1548], [https://attack.mitre.org/techniques/T1055/ T1055], [https://attack.mitre.org/techniques/T1106/ T1106], [https://attack.mitre.org/techniques/T1569/ T1569], [https://attack.mitre.org/techniques/T1027/ T1027] * '''Last Updated''': 2017-08-23
@@ -1536,6 +1706,14 @@ Attackers are finding stealthy ways "live off the land," leveraging utilities an | PowerShell | Execution |- +| T1197 +| BITS Jobs +| Defense Evasion, Persistence +|- +| T1105 +| Ingress Tool Transfer +| Command and Control +|- | T1003 | OS Credential Dumping | Credential Access @@ -2610,7 +2788,7 @@ Monitor and detect registry changes initiated from remote locations, which can b * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1548.002/ T1548.002], [https://attack.mitre.org/techniques/T1112/ T1112], [https://attack.mitre.org/techniques/T1222.001/ T1222.001], [https://attack.mitre.org/techniques/T1547.010/ T1547.010], [https://attack.mitre.org/techniques/T1564.001/ T1564.001], [https://attack.mitre.org/techniques/T1547.001/ T1547.001], [https://attack.mitre.org/techniques/T1546.012/ T1546.012], [https://attack.mitre.org/techniques/T1546.011/ T1546.011], [https://attack.mitre.org/techniques/T1546.001/ T1546.001], [https://attack.mitre.org/techniques/T1036/ T1036], [https://attack.mitre.org/techniques/T1562.001/ T1562.001] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1548.002/ T1548.002], [https://attack.mitre.org/techniques/T1547.010/ T1547.010], [https://attack.mitre.org/techniques/T1564.001/ T1564.001], [https://attack.mitre.org/techniques/T1547.001/ T1547.001], [https://attack.mitre.org/techniques/T1546.012/ T1546.012], [https://attack.mitre.org/techniques/T1546.011/ T1546.011], [https://attack.mitre.org/techniques/T1546.001/ T1546.001] * '''Last Updated''': 2018-05-31
@@ -2646,14 +2824,6 @@ Monitor and detect registry changes initiated from remote locations, which can b | Bypass User Account Control | Defense Evasion, Privilege Escalation |- -| T1112 -| Modify Registry -| Defense Evasion -|- -| T1222.001 -| Windows File and Directory Permissions Modification -| Defense Evasion -|- | T1547.010 | Port Monitors | Persistence, Privilege Escalation @@ -2677,14 +2847,6 @@ Monitor and detect registry changes initiated from remote locations, which can b | T1546.001 | Change Default File Association | Persistence, Privilege Escalation -|- -| T1036 -| Masquerading -| Defense Evasion -|- -| T1562.001 -| Disable or Modify Tools -| Defense Evasion |} @@ -2945,7 +3107,7 @@ Detect tactics used by malware to evade defenses on Windows endpoints. A few of * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1548.002/ T1548.002], [https://attack.mitre.org/techniques/T1112/ T1112], [https://attack.mitre.org/techniques/T1222.001/ T1222.001], [https://attack.mitre.org/techniques/T1547.010/ T1547.010], [https://attack.mitre.org/techniques/T1564.001/ T1564.001], [https://attack.mitre.org/techniques/T1547.001/ T1547.001], [https://attack.mitre.org/techniques/T1546.012/ T1546.012], [https://attack.mitre.org/techniques/T1546.011/ T1546.011], [https://attack.mitre.org/techniques/T1546.001/ T1546.001], [https://attack.mitre.org/techniques/T1036/ T1036], [https://attack.mitre.org/techniques/T1562.001/ T1562.001] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1562.001/ T1562.001], [https://attack.mitre.org/techniques/T1564.001/ T1564.001], [https://attack.mitre.org/techniques/T1548.002/ T1548.002], [https://attack.mitre.org/techniques/T1112/ T1112], [https://attack.mitre.org/techniques/T1222.001/ T1222.001], [https://attack.mitre.org/techniques/T1036/ T1036] * '''Last Updated''': 2018-05-31
@@ -2953,8 +3115,30 @@ Detect tactics used by malware to evade defenses on Windows endpoints. A few of ====Detection Profile==== +* [[Documentation:ESSOC:detections:Detections#Disable_registry_tool|Disable Registry Tool]] + +* [[Documentation:ESSOC:detections:Detections#Disable_show_hidden_files|Disable Show Hidden Files]] + +* [[Documentation:ESSOC:detections:Detections#Disable_windows_behavior_monitoring|Disable Windows Behavior Monitoring]] + +* [[Documentation:ESSOC:detections:Detections#Disable_windows_smartscreen_protection|Disable Windows SmartScreen Protection]] + +* [[Documentation:ESSOC:detections:Detections#Disabling_cmd_application|Disabling CMD Application]] + +* [[Documentation:ESSOC:detections:Detections#Disabling_controlpanel|Disabling ControlPanel]] + +* [[Documentation:ESSOC:detections:Detections#Disabling_firewall_with_netsh|Disabling Firewall with Netsh]] + +* [[Documentation:ESSOC:detections:Detections#Disabling_folderoptions_windows_feature|Disabling FolderOptions Windows Feature]] + +* [[Documentation:ESSOC:detections:Detections#Disabling_norun_windows_app|Disabling NoRun Windows App]] + * [[Documentation:ESSOC:detections:Detections#Disabling_remote_user_account_control|Disabling Remote User Account Control]] +* [[Documentation:ESSOC:detections:Detections#Disabling_systemrestore_in_registry|Disabling SystemRestore In Registry]] + +* [[Documentation:ESSOC:detections:Detections#Disabling_task_manager|Disabling Task Manager]] + * [[Documentation:ESSOC:detections:Detections#Eventvwr_uac_bypass|Eventvwr UAC Bypass]] * [[Documentation:ESSOC:detections:Detections#Fodhelper_uac_bypass|FodHelper UAC Bypass]] @@ -2979,6 +3163,14 @@ Detect tactics used by malware to evade defenses on Windows endpoints. A few of ! Technique ! Tactic |- +| T1562.001 +| Disable or Modify Tools +| Defense Evasion +|- +| T1564.001 +| Hidden Files and Directories +| Defense Evasion +|- | T1548.002 | Bypass User Account Control | Defense Evasion, Privilege Escalation @@ -2991,37 +3183,9 @@ Detect tactics used by malware to evade defenses on Windows endpoints. A few of | Windows File and Directory Permissions Modification | Defense Evasion |- -| T1547.010 -| Port Monitors -| Persistence, Privilege Escalation -|- -| T1564.001 -| Hidden Files and Directories -| Defense Evasion -|- -| T1547.001 -| Registry Run Keys / Startup Folder -| Persistence, Privilege Escalation -|- -| T1546.012 -| Image File Execution Options Injection -| Persistence, Privilege Escalation -|- -| T1546.011 -| Application Shimming -| Persistence, Privilege Escalation -|- -| T1546.001 -| Change Default File Association -| Persistence, Privilege Escalation -|- | T1036 | Masquerading | Defense Evasion -|- -| T1562.001 -| Disable or Modify Tools -| Defense Evasion |} @@ -4221,7 +4385,7 @@ Detect and investigate dormant user accounts for your AWS environment that have * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1078.004/ T1078.004] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1526/ T1526], [https://attack.mitre.org/techniques/T1078.004/ T1078.004] * '''Last Updated''': 2018-03-12
@@ -4229,6 +4393,8 @@ Detect and investigate dormant user accounts for your AWS environment that have ====Detection Profile==== +* [[Documentation:ESSOC:detections:Detections#Aws_excessive_security_scanning|AWS Excessive Security Scanning]] + * [[Documentation:ESSOC:detections:Detections#Detect_api_activity_from_users_without_mfa|Detect API activity from users without MFA]] * [[Documentation:ESSOC:detections:Detections#Detect_aws_api_activities_from_unapproved_accounts|Detect AWS API Activities From Unapproved Accounts]] @@ -4247,6 +4413,10 @@ Detect and investigate dormant user accounts for your AWS environment that have ! Technique ! Tactic |- +| T1526 +| Cloud Service Discovery +| Discovery +|- | T1078.004 | Cloud Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation @@ -5132,7 +5302,7 @@ Monitor your cloud infrastructure provisioning activities for behaviors originat ===Suspicious cloud user activities=== Detect and investigate suspicious activities by users and roles in your cloud environments. -* '''Product''': Splunk Security Analytics for AWS, Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Product''': Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Change * '''ATT&CK''': [https://attack.mitre.org/techniques/T1078.004/ T1078.004], [https://attack.mitre.org/techniques/T1078/ T1078] * '''Last Updated''': 2020-09-04 @@ -6827,7 +6997,7 @@ Reduce the risk of CVE-2018-11409, an information disclosure vulnerability withi '' ############# # Automatically generated by doc_gen.py in https://github.com/splunk/security_content -# On Date: 2021-04-02 17:10:21.639044 UTC +# On Date: 2021-04-15 19:33:38.229931 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/package/README.md b/package/README.md new file mode 100644 index 0000000000..d0a87c3f9b --- /dev/null +++ b/package/README.md @@ -0,0 +1,7 @@ +# Splunk ES Content Update + +This subscription service delivers pre-packaged Security Content for use with Splunk Enterprise Security. Subscribers get regular updates to help security practitioners more quickly address ongoing and time-sensitive customer problems and threats. + +Requires Splunk Enterprise Security version 4.5 or greater. + +For more information please visit the [Splunk ES Content Update user documentation](https://docs.splunk.com/Documentation/ESSOC). \ No newline at end of file diff --git a/package/README/essoc_story_detail.txt b/package/README/essoc_story_detail.txt new file mode 100644 index 0000000000..5333752842 --- /dev/null +++ b/package/README/essoc_story_detail.txt @@ -0,0 +1,15 @@ +The Analytic Story Details dashboard renders all the details of the content related to a specific analytic story which +can be chose via the drop down + +Each analytic story has attributes associated with it and the following: +______________________________________________________________________ + + + Analytic Story: name of the analytic story + Description ; description of the analytic story + Search Name : The name of the searches belonging to the chosen analytic story + Search : The search query which looks for an attack pattern corresponding to the analytic story + Search Description: The description of the search query + Asset Type: The analytic story specifies what asset in the infrastructure may be compromised + Category: The category that the search belongs to (malware, vulnerabilities, best practices, abuse) + Kill Chain Phase: The kill chain phase of the attack that the search is after. \ No newline at end of file diff --git a/package/README/essoc_summary.txt b/package/README/essoc_summary.txt new file mode 100644 index 0000000000..d7dde31ec6 --- /dev/null +++ b/package/README/essoc_summary.txt @@ -0,0 +1,24 @@ +The ES_SOC Summary Dashboard provides you a summarized view of the analytic story contents of the ES-SOC app. +The dashboard has the following panels gives you following details + +1) Analytic story Summary + - Total Analytic Stories : The total number of Analytic stories in the ES-SOC application + - Total Searches: The total number of searches in ES-SOC + - Searches added last week: Number of searches added to ES-SOC in the last week. + + 2) Analytic story Category: This dashboard panel summarizes the categories of the searches that the ES-SOC app contains. The categories of the analytic stories are as follow + -Malware: These searches detect specific malware behavior for a particular phase of the attack kill chain. E.g. a malware’s delivery method via email or a malware’s installation behavior via registry key changes + -Vulnerability: These searches detect behavior or a signature of a vulnerable software in use. These searches are not designed to replace vulnerability management or scanning systems. The purpose of these searches is to discover a vulnerability through side effects or behaviors. + -Abuse: Some actions can be deemed malicious because they are unexpected, violate corporate policy or are significantly different than the actions of other users. E.g. A USB disk that is seen on multiple systems or a user that uploads excessive files to a cloud service or a database query that dumps an entire table + -Best Practices: Searches that correspond to specific guidelines from organizations like SANS or OWASP + + 3) Kill Chain phases: Every analytic story has one or more searches which look for a certain kind of attack pattern/behavior. These searches have an attribute which essentially tells you what Kill chain phase does the search correspond to. + The numbers on the dashboard represents the number of searches correponding to each kill chain phase + + 4) Analytic story table: This table gives the user a comprehensive view of some of the details of the analytic story. Some of the listed attributes are: + - Analytic Story : The name of the analytic story + - Description: The description of the analyttic story + - Search names: The name of the searches in each analytic story + - Datamodels: The name of the datamodel that the search is querying against. + - Technology Examples: This field represent some examples related to the technologies required to populate the datamodels(Nessues, Cisco Firewall,etc) + - Kill chain phase: The name of the kill chain phase that the search belongs to \ No newline at end of file diff --git a/package/README/essoc_usage_dashboard.txt b/package/README/essoc_usage_dashboard.txt new file mode 100644 index 0000000000..fcbc842881 --- /dev/null +++ b/package/README/essoc_usage_dashboard.txt @@ -0,0 +1,51 @@ +###################### +ESSOC Usage Dashboard# +###################### + +The ESSOC Usage dashboard is designed to provide high-level insight into the usage of the ES-SOC app. It is suitable for display when providing feedback to the Splunk team or for identifying how the ES-SOC app is being used. This dashboard has two time selectors that work independently - the top time selector determines the search time range for all the single-value. And the lower time selector, determines the time range for the usage table. + +IMPORTANT: The user loading this dashboard must have permission to search the _audit index + +################## +#Dashboard panels# +################## + +Searches Ran + +The total number of searches in ES-SOC that were executed. This number includes scheduled searches and ad hoc searches run from the search bar using the '| savedsearch ‘ syntax + +Unique Searches + +The unique/distinct searches executed on the deployment. This is equivalent to the distinct count of searches run in the ES-SOC app. + +Most Run + +The total number of searches in ES-SOC that were executed. This number includes scheduled searches and ad hoc searches run from the search bar using the '| savedsearch ‘ syntax. + +Ad hoc Searches + +The total number of searches run from the search bar using the '| savedsearch ‘ syntax. + +Scheduled + +The total number of ESSOC searches run that were scheduled. + +Most Active User + +The user who executed the highest number/count of searches. This calculation includes scheduled searches and ad hoc searches run from the search bar using the '| savedsearch ‘ syntax. + +Search Run Time (seconds) + +Total run time of all searches executed in seconds. This calculation includes scheduled searches and ad hoc searches run from the search bar using the '| savedsearch ‘ syntax. + +Average Run Time (seconds) + +Average run time of all searches executed in seconds. This calculation includes scheduled searches and ad hoc searches run from the search bar using the '| savedsearch ‘ syntax. + +Max Run Time (seconds) + +The run time of the longest running search. This calculation includes scheduled searches and ad hoc searches run from the search bar using the '| savedsearch ‘ syntax. + +Search summary + +This table provides details on each search that was executed in the ESSOC app. \ No newline at end of file diff --git a/package/app.manifest b/package/app.manifest new file mode 100644 index 0000000000..4bc6dbc051 --- /dev/null +++ b/package/app.manifest @@ -0,0 +1,46 @@ +{ + "schemaVersion": "1.0.0", + "info": { + "title": "ES Content Updates", + "id": { + "group": null, + "name": "DA-ESS-ContentUpdate", + "version": "3.19.0" + }, + "author": [ + { + "name": "Splunk Security Research Team", + "email": "research@splunk.com", + "company": "Splunk" + } + ], + "releaseDate": null, + "description": "Explore the Analytic Stories included with ES Content Updates.", + "classification": { + "intendedAudience": null, + "categories": [], + "developmentStatus": null + }, + "commonInformationModels": null, + "license": { + "name": null, + "text": null, + "uri": null + }, + "privacyPolicy": { + "name": null, + "text": null, + "uri": null + }, + "releaseNotes": { + "name": null, + "text": "./README.md", + "uri": null + } + }, + "dependencies": null, + "tasks": null, + "inputGroups": null, + "incompatibleApps": null, + "platformRequirements": null +} \ No newline at end of file diff --git a/package/appserver/static/alert_escu_contextualize.png b/package/appserver/static/alert_escu_contextualize.png new file mode 100644 index 0000000000..23c161b5c2 Binary files /dev/null and b/package/appserver/static/alert_escu_contextualize.png differ diff --git a/package/appserver/static/alert_escu_investigate.png b/package/appserver/static/alert_escu_investigate.png new file mode 100644 index 0000000000..23c161b5c2 Binary files /dev/null and b/package/appserver/static/alert_escu_investigate.png differ diff --git a/package/appserver/static/alerticon.png b/package/appserver/static/alerticon.png new file mode 100644 index 0000000000..c7f9d26890 Binary files /dev/null and b/package/appserver/static/alerticon.png differ diff --git a/package/appserver/static/analytic_story_details.css b/package/appserver/static/analytic_story_details.css new file mode 100644 index 0000000000..ce54b7882b --- /dev/null +++ b/package/appserver/static/analytic_story_details.css @@ -0,0 +1,187 @@ +/* .rTable { + display: table; + width: 100%; +} + +.rTableRow { + display: table-row; +} + +.rTableHeading { + display: table-header-group; + background-color: #ddd; +} + +.rTableCell, .rTableHead { + display: table-cell; + padding: 3px 10px; + //border: 1px solid #999999; +} + +.rTableLeftCell { + display: table-cell; + padding: 3px 10px; + //border: 1px solid #999999; + width: 200px; +} + +.rTableHeading { + display: table-header-group; + background-color: #ddd; + font-weight: bold; +} + +.rTableFoot { + display: table-footer-group; + font-weight: bold; + background-color: #ddd; +} + +.rTableBody { + display: table-row-group; +} */ + +h1 { + font-size: 24px; + font-weight: 200; + margin: 0; +} + +h3 { + padding-left: 10px; +} + +.as_title_attr_bar { + padding-left: 15%; + background-color: #eee; + height: 40px; + line-height: 40px; + margin-bottom: 7px; +} + +.as_title_attr { + float: left; + margin-right: 5%; + padding-right: 20px; + font-size: 14px; +} + +.as_search_accordion { + width: 100%; + margin-top: 10px; +} + +.as_story_details { + display: flex; + max-height: 500px; + clear: both; +} + +.as_story_details_left_col { + float: right; + width: 34%; + display: block; + overflow: scroll; + padding: 10px; + margin: 10px; + border: 1px solid #ddd; +} + +.as_story_details_right_col { + float: left; + width: 60%; + overflow: scroll; + padding: 10px; + margin: 10px; + border: 1px solid #ddd; +} + +.as_left_attr{ + display: inline-block; + width: 100%; +} + +.as_story_detail_left_attr_label { + float: left; + width: 30%; + padding-top: 2%; +} + +.as_story_detail_left_attr { + margin-top: 5px; + float: left; + width: 70%; +} + +.value_label { + float: left; + margin-right: 5px; + background-color: #eee; + padding: 4px; + border-radius: 6px; + margin-bottom: 5px; +} + +.as_story_detail_right_attr_label { + margin-bottom: 7px; +} + +.search_content { + display: flex; + clear: both; +} + +.search_left_panel { + float: left; + width: 70%; + margin: 10px; + padding: 10px; + border: 1px solid #ddd; +} + +.search_right_panel { + float: left; + width: 25%; + margin: 10px; + padding: 10px; + border: 1px solid #ddd; +} + +.search_left_attr { + margin: 10px; +} + +.search_right_attr { + margin: 10px; + display: table; +} + +.search_string{ + padding: 10px; + background-color: #ddd; + border: 1px solid #aaa; + border-radius: 2px; +} + +.data_model_tag { + background-color: #11a88b; +} + +.kill_chain_tag { + background-color: #ed8440; + color: #303841; +} + +.attack_tag { + background-color: #3863a0; + color: #eee; +} + +.heading-story { + width: 80%; + float: left; +} + +.run_story_btn { + float: right; +} \ No newline at end of file diff --git a/package/appserver/static/analytic_story_details.js b/package/appserver/static/analytic_story_details.js new file mode 100644 index 0000000000..932b4426f0 --- /dev/null +++ b/package/appserver/static/analytic_story_details.js @@ -0,0 +1,575 @@ +require([ + 'underscore', + 'jquery', + 'splunkjs/mvc', + 'splunkjs/mvc/searchmanager', + 'splunkjs/mvc/searchbarview', + 'splunkjs/mvc/tableview', + 'splunk.util', + '../app/DA-ESS-ContentUpdate/js/lib/showdown.min', + '../app/DA-ESS-ContentUpdate/js/lib/jquery-ui/jquery-ui', + 'css!../app/DA-ESS-ContentUpdate/js/lib/jquery-ui/jquery-ui.css', + 'css!../app/DA-ESS-ContentUpdate/analytic_story_details.css', + 'splunkjs/mvc/simplexml/ready!' +], function(_, $, mvc, SearchManager, SearchBarView, TableView, splunkUtil, showdown) { + + let tokenModel = mvc.Components.get("default"); + let renderedComponents = []; + + let templ = ` +
+
+ Category: +
+
+ Version: +
+
+ Created: +
+
+ Modified: +
+
+
+
+

+
+
+ +
+
+
+
+
+ Description: +
+
+ +
+
+ Narrative: +
+
+ +
+
+
+
+
+ ATT&CK: +
+
+
+
+
+
+ Kill Chain Phases: +
+
+
+
+
+
+ CIS Controls: +
+
+
+
+
+
+ Data Model: +
+
+
+
+
+
+ References: +
+
+
+
+
+
+
+

+ Analytic Story Searches +

+
+

Detection

+
+
+
+
+

Investigative

+
+
+
+
+

Support

+
+
+
+
+
+
+ `; + + $('#analytic_story_details').html(_.template(templ)); + + if (tokenModel.get('analytic_story_name')) { + fetchAnalyticStoryDetails(tokenModel.get('analytic_story_name')); + } + + tokenModel.on("change:analytic_story_name", function(model, value, options) { + fetchAnalyticStoryDetails(value); + }); + + function fetchAnalyticStoryDetails(asName) { + let epoch = (new Date).getTime(); + let searchGetAnalyticStoryData = new SearchManager({ + id: epoch, + earliest_time: "-1h@h", + latest_time: "now", + cache: false, + search: "| rest /services/configs/conf-analytic_stories splunk_server=local count=0 | search title=\"" + asName + "\" | spath input=reference path={} output=ref | spath input=data_models path={} output=dm | table title, category, description, version, mappings, creation_date, modification_date, dm, narrative, ref" + }); + + $('.run-story').unbind('click'); + + $('.run-story').on('click', function(evt) { + window.open('/en-US/app/Splunk_ASX/execute?form.mode=now&form.cron=*%2F15%20*%20*%20*%20*&form.earliest_time=-15m&form.latest_time=now&form.time.earliest=-24h%40h&form.time.latest=now&form.story=' + asName); + }); + + let asSearch = splunkjs.mvc.Components.getInstance(epoch); + let asResults = asSearch.data("results", { + count: 0 + }); + asResults.on("data", function() { + let as_attributes = {}; + let fields = asResults.data().fields; + let rows = asResults.data().rows; + + for (let i = 0; i < fields.length; i++) { + as_attributes[fields[i]] = rows[0][i]; + } + renderStoryAttributes(as_attributes); + }); + + var searchGetSearchesData = new SearchManager({ + id: "s" + epoch, + earliest_time: "-1h@h", + latest_time: "now", + cache: false, + search: "| rest /services/saved/searches splunk_server=local count=0 | spath input=action.escu.analytic_story path={} output=uc | search uc = \"" + asName + "\" | spath input=action.escu.data_models path={} output=dm | table action.escu.full_search_name, search, description, action.escu.search_type, action.escu.how_to_implement, action.escu.eli5, action.escu.version, action.escu.mappings, dm, tex, action.escu.asset_at_risk, action.escu.confidence, action.escu.known_false_positives, updated, action.escu.modification_date, action.escu.creation_date " + + }); + var searchesSearch = splunkjs.mvc.Components.getInstance("s" + epoch); + var searchesResults = searchesSearch.data("results", { + count: 0 + }); + + + searchesResults.on("data", function() { + let asSearchAttr = []; + var fields = searchesResults.data().fields; + var rows = searchesResults.data().rows; + + for (let i = 0; i < rows.length; i++) { + let searchObj = {}; + for (let j = 0; j < fields.length; j++) { + searchObj[fields[j]] = rows[i][j]; + } + asSearchAttr.push(searchObj); + } + renderSearches(asSearchAttr); + }); + } + + function renderStoryAttributes(asAttributes) { + let converter = new showdown.Converter(); + let mappings = JSON.parse(asAttributes.mappings); + $('#as_label_category').html(asAttributes.category); + $('#as_label_version').html(asAttributes.version); + $('#as_label_created').html(asAttributes.creation_date); + $('#as_label_modified').html(asAttributes.modification_date); + $('#story_heading').html(asAttributes.title); + $('#attack').html(mappings.mitre_attack); + $('#narrative').html(converter.makeHtml(asAttributes.narrative)); + $('#description').html(converter.makeHtml(asAttributes.description)); + $('#mitre_attack').html(getValueLabels(mappings.mitre_attack, 'attack_tag')); + $('#data_model').html(getValueLabels(asAttributes.dm, 'data_model_tag')); + $('#kill_chain_phases').html(getValueLabels(mappings.kill_chain_phases, 'kill_chain_tag')); + $('#cis_20').html(getValueLabels(mappings.cis20)); + $('#references').html(getReferenceURLS(asAttributes.ref)); + } + + function getReferenceURLS(refs) { + if (refs === null) { + return " "; + } else { + let refsResult = ``; + if (Array.isArray(refs)) { + refs.map(ref => { + refsResult = refsResult + `${ ref }
`; + }); + } else { + refsResult = refsResult + `${ refs }
` + } + + return refsResult; + } + } + + function renderSearches(asSearches) { + clearSearchView(); + let i = 0; + let converter = new showdown.Converter(); + asSearches.forEach(search => { + i++; + let epoch = (new Date).getTime(); + let searchID = `#search${ i }`; + let resultID = `#result${ i }`; + let searchSelector = `search${ i }`; + let controlID = `as_search${ i }` + let resultsControlID = `as_results_search${ i }`; + let btnID = `btn_es_${i}`; + + let searchPanel = ` +

${ search['action.escu.full_search_name'] }

+
+
+ +
+
+ Description +
+
+ ${ converter.makeHtml(search['description']) } +
+
+
+
+
+
+ Search +
+
+
+
+
+
+
+
+ How to Implement +
+
+ ${ converter.makeHtml(search['action.escu.how_to_implement']) } +
+
+
+
+ Known False Positives +
+
+ ${ converter.makeHtml(search['action.escu.known_false_positives']) } +
+
+
+
+
+
+ Data Models +
+
+ ${ getValueLabels(search['dm'], 'data_model_tag') } +
+
+
+
`; + + if (search['action.escu.search_type'] === "support") { + //Process Support Search Accordion + + let mappings = JSON.parse(search['action.escu.mappings']); + $('#search_support').append(searchPanel); + + // Adding extra params to support search + let supportLeftAttr = `
+
+ Explain It Like I'm 5 +
+
+ ${ converter.makeHtml(search['action.escu.eli5']) } +
+
`; + + + $(`#${searchSelector}-eli5`).append(supportLeftAttr); + + } else if (search['action.escu.search_type'] === "detection") { + let mappings = JSON.parse(search['action.escu.mappings']); + $('#search_detection').append(searchPanel); + // Adding extra params to detection search + let detectionAttrTop = ` +
+
+ ATT&CK +
+
+ ${ getValueLabels(mappings.mitre_attack, 'attack_tag') } +
+
+
+
+ Kill Chain Phases +
+
+ ${ getValueLabels(mappings.kill_chain_phases, 'kill_chain_tag') } +
+
+
+
+ CIS Controls +
+
+ ${ getValueLabels(mappings.cis20) } +
+
+ `; + + let detectionAttrBottom = ` +
+
+ Asset at Risk +
+
+ ${ search['action.escu.asset_at_risk'] } +
+
+
+
+ Confidence +
+
+ ${ search['action.escu.confidence'] } +
+
+
+
+ Creation Date +
+
+ ${ search['action.escu.creation_date'] } +
+
+
+
+ Modification Date +
+
+ ${ search['action.escu.modification_date'] } +
+
`; + + let detectionLeftAttr = `
+
+ Explain It Like I'm 5 +
+
+ ${ converter.makeHtml(search['action.escu.eli5']) } +
+
`; + $(detectionAttrTop).insertBefore($(`#${searchSelector}-content`).find('.data_model_srch_attr')); + $(`#${searchSelector}-content`).find('.search_right_panel').append(detectionAttrBottom); + $(`#${searchSelector}-eli5`).append(detectionLeftAttr); + } else if (search['action.escu.search_type'] === "contextual") { + //Process contextual Search Accordion + + let mappings = JSON.parse(search['action.escu.mappings']); + $('#search_contextual').append(searchPanel); + + + // Adding extra params to contextual search + let contextualLeftAttr = `
+
+ Explain It Like I'm 5 +
+
+ ${ converter.makeHtml(search['action.escu.eli5']) } +
+
`; + $(`#${searchSelector}-eli5`).append(contextualLeftAttr); + + } else if (search['action.escu.search_type'] === "investigative") { + //Process Investigative Search Accordion + let mappings = JSON.parse(search['action.escu.mappings']); + $('#search_investigative').append(searchPanel); + + // Adding extra params to investigative search + let investigativeLeftAttr = `
+
+ Explain It Like I'm 5 +
+
+ ${ converter.makeHtml(search['action.escu.eli5']) } +
+
`; + + + $(`#${searchSelector}-eli5`).append(investigativeLeftAttr); + } + + /* + let updatedAttr = ` +
+
+ Last Updated +
+
+ ${ search['updated'] } +
+
+ `; + $(`#${searchSelector}-content`).find('.search_right_panel').append(updatedAttr); + */ + + $(`#${ btnID }`).on('click', (evt) => { + console.log($(evt.target).data("searchType")); + if ($(evt.target).data("searchType") === "detection") { + splunkUtil.redirect_to('app/SplunkEnterpriseSecuritySuite/correlation_search_edit', { + search: `${$(evt.target).data("searchName")}` + }, window.open(), true); + } else { + splunkUtil.redirect_to(`manager/DA-ESS-ContentUpdate/saved/searches`, { + search: `${$(evt.target).data("searchName")}` + }, window.open(), true); + } + }) + + let searchManagerID = search['action.escu.full_search_name'].split(' ').join(''); + + let searchManager = new SearchManager({ + id: searchManagerID, + earliest_time: "-24h@h", + latest_time: "now", + status_buckets: 300, + required_field_list: "*", + preview: true, + cache: true, + autostart: false, // Prevent the search from running automatically + search: search['search'], + }); + + let searchBar = new SearchBarView({ + id: searchID, + managerId: searchManagerID, + timerange: true, + el: $('.' + controlID), + value: search['search'], + timerange_preset: "Last 24 hours" + }).render(); + + let tableviewer = new TableView({ + id: resultsControlID, + managerid: searchManagerID, + pageSize: 5, + el: $("." + resultsControlID) + }).render(); + + searchBar.on("change", function() { + searchManager.settings.unset("search"); + + // Update the search query + searchManager.settings.set("search", searchBar.val()); + + // Run the search (because autostart=false) + searchManager.startSearch(); + }); + + searchBar.timerange.on("change", function() { + // Update the time range of the search + searchManager.search.set(searchBar.timerange.val()); + + // Run the search (because autostart=false) + searchManager.startSearch(); + }) + + + renderedComponents.push(searchID, searchManagerID, resultsControlID); + + }); + + $('#accordion').accordion({ + heightStyle: "content" + }); + $('#search_support').accordion({ + heightStyle: "content" + }); + $('#search_detection').accordion({ + heightStyle: "content" + }); + $('#search_contextual').accordion({ + heightStyle: "content" + }); + $('#search_investigative').accordion({ + heightStyle: "content" + }); + } + + function clearSearchView() { + if ($('#accordion').hasClass('ui-accordion')) { + $('#accordion').accordion('destroy'); + } + + if ($('#search_support').hasClass('ui-accordion')) { + $('#search_support').accordion('destroy'); + $('#search_support').empty(); + } + + if ($('#search_detection').hasClass('ui-accordion')) { + $('#search_detection').accordion('destroy'); + $('#search_detection').empty(); + } + + if ($('#search_contextual').hasClass('ui-accordion')) { + $('#search_contextual').accordion('destroy'); + $('#search_contextual').empty(); + } + + if ($('#search_investigative').hasClass('ui-accordion')) { + $('#search_investigative').accordion('destroy'); + $('#search_investigative').empty(); + } + + $('.configure_in_es').unbind("click"); + + let len = renderedComponents.length; + while (len--) { + let id = renderedComponents.pop(); + mvc.Components.getInstance(id).dispose(); + } + } + + function getValueLabels(values, className) { + let cls = ""; + if (className !== undefined || className) { + cls = className; + } + let valueArray = []; + if (values) { + if (typeof values === "string") { + valueArray.push(values) + } else { + valueArray = values; + } + } + let htmlTmpl = ""; + valueArray.forEach(val => { + htmlTmpl += `
${ val }
 ` + }); + + return htmlTmpl; + } +}); diff --git a/package/appserver/static/escu_summary.css b/package/appserver/static/escu_summary.css new file mode 100644 index 0000000000..48fe5b72c3 --- /dev/null +++ b/package/appserver/static/escu_summary.css @@ -0,0 +1,66 @@ +.btn-pill { + display: inline; +} + +.killchain-phases { + width: 100%; + margin-left: 6%; +} + +.killchain_card { + width: 14%; + float:left; +} + +.killchain { + height: 55px; + line-height: 55px; + -webkit-clip-path: polygon(75% 0%, 100% 50%, 75% 100%, 0% 100%, 25% 50%, 0% 0%); + clip-path: polygon(75% 0%, 100% 50%, 75% 100%, 0% 100%, 25% 50%, 0% 0%); +} + +.killchain-text { + font-size: 300%; + font-weight: 600; + color: #fff; + text-align: center; + white-space: wrap; +} + + +.killchain-label { + margin-top: 7px; + text-align: center; + color: #666; + font-size: 14px; + font-weight: 700; + margin-left: 10%; + width: 60%; +} + +.killchain-text-one-line { + font-size: 16px; + color: #fff; + font-family: system-ui; + white-space: wrap; + width: 100%; + padding-top: 7%; + padding-left: 26%; +} + +.killchain-text-second { + font-size: 16px; + color: #fff; + font-family: system-ui; + margin-top: -10px; + padding-left: 26%; +} + +.killchain-phases { + display: inline-block; + width: 100%; +} + +.notfirst { + margin-left: -2%; +} diff --git a/package/appserver/static/escu_summary.js b/package/appserver/static/escu_summary.js new file mode 100644 index 0000000000..572eef9abb --- /dev/null +++ b/package/appserver/static/escu_summary.js @@ -0,0 +1,76 @@ +require([ + 'underscore', + 'jquery', + 'splunkjs/mvc', + 'splunkjs/mvc/searchmanager', + '../app/DA-ESS-ContentUpdate/js/lib/tabs', + 'css!../app/DA-ESS-ContentUpdate/js/lib/tabs.css', + 'css!../app/DA-ESS-ContentUpdate/escu_summary.css', + 'splunkjs/mvc/simplexml/ready!' + ], function(_, $, mvc, SearchManager) { + $('.es-soc-analytic-story-stats').html(_.template('<%- _("Analytic Story Summary").t() %>')); + $('.es-soc-search-stats').html(_.template('<%- _("Search Summary").t() %>')); + + const tokenModel = mvc.Components.get('default'); + const submittedTokens = mvc.Components.get('submitted'); + + $.ajax({ + url: Splunk.util.make_url('/splunkd/__raw/servicesNS/nobody/DA-ESS-ContentUpdate/apps/local'), + type: 'GET', + async: true, + data: { + output_mode: 'json', + count: -1, + }, + }).done(result => { + if (result.entry) { + const foundEss = result.entry.find(app => app.name === 'SplunkEnterpriseSecuritySuite'); + if (foundEss.content.version === "5.2.0") { + submittedTokens.set('explore-use-case-es-show', 'true'); + const use_case_library_link = Splunk.util.make_url('app/SplunkEnterpriseSecuritySuite/ess_use_case_library'); + const template = `
+ ${ _('Εxplore ESCU content updates directly from the Use Case Library within ES. To explore it, click').t() } + ${ _('here').t() }. +
`; + $('#explore-use-case-es-info').html(_.template(template, { use_case_library_link: use_case_library_link })); + } + } + }).fail(err => { + }); + + + + // searchQuery - + let kcpSearch = new SearchManager({ + id: "kcpSearch", + preview: true, + cache: true, + status_buckets: 300, + earliest_time: '-24h@h', + latest_time: 'now', + search: '| rest /services/configs/conf-analytic_stories splunk_server=local count=0 | spath input=mappings path=kill_chain_phases{} output=kcp | stats count by kcp', + }); + + let results = kcpSearch.data("preview"); + + results.on("data", function() { + results.data().rows.forEach(row => { + let killchainID = '#' + row[0].toLowerCase().replace(/ /g,''); + $(killchainID).html(row[1]); + }); + }); + + $('#analytic_filter_clear').on('click', function() { + tokenModel.set('form.as_cis', '*'); + tokenModel.set('form.as_category', '*'); + tokenModel.set('form.as_kill_chain_phase', '*'); + tokenModel.set('form.as_data_models', '*'); + }); + + $('#search_filter_clear').on('click', function() { + tokenModel.set('form.cis', '*'); + tokenModel.set('form.searchtype', '*'); + tokenModel.set('form.kill_chain_phase', '*'); + tokenModel.set('form.data_models', '*'); + }); + }); diff --git a/package/appserver/static/feedback.js b/package/appserver/static/feedback.js new file mode 100644 index 0000000000..48c3f4cb74 --- /dev/null +++ b/package/appserver/static/feedback.js @@ -0,0 +1,19 @@ + + require([ + 'underscore', + 'jquery', + 'splunkjs/mvc', + 'splunkjs/mvc/simplexml/ready!' + ], function(_, $, mvc, TableView) { + + var defaultTokenSpace = mvc.Components.getInstance('default'); + + // This will take every textarea that has a data-token attribute and will make the given token with the value of the textarea + $('textarea[data-token]').each(function (textarea) { + $(this).on('input', function(input) { + var token_to_set = $(this).data('token'); + defaultTokenSpace.set(token_to_set, $(this).val()); + }) + }) + }); + diff --git a/package/appserver/static/img/escu/Slide1.PNG b/package/appserver/static/img/escu/Slide1.PNG new file mode 100644 index 0000000000..4e5f7311ac Binary files /dev/null and b/package/appserver/static/img/escu/Slide1.PNG differ diff --git a/package/appserver/static/img/escu/Slide2.PNG b/package/appserver/static/img/escu/Slide2.PNG new file mode 100644 index 0000000000..7f33c545ca Binary files /dev/null and b/package/appserver/static/img/escu/Slide2.PNG differ diff --git a/package/appserver/static/img/escu/Slide3.PNG b/package/appserver/static/img/escu/Slide3.PNG new file mode 100644 index 0000000000..efc6a8de98 Binary files /dev/null and b/package/appserver/static/img/escu/Slide3.PNG differ diff --git a/package/appserver/static/img/escu/Slide4.PNG b/package/appserver/static/img/escu/Slide4.PNG new file mode 100644 index 0000000000..5780daa26e Binary files /dev/null and b/package/appserver/static/img/escu/Slide4.PNG differ diff --git a/package/appserver/static/img/escu/Slide5.PNG b/package/appserver/static/img/escu/Slide5.PNG new file mode 100644 index 0000000000..fc21341750 Binary files /dev/null and b/package/appserver/static/img/escu/Slide5.PNG differ diff --git a/package/appserver/static/img/escu/Slide6.PNG b/package/appserver/static/img/escu/Slide6.PNG new file mode 100644 index 0000000000..bb0cfaefdd Binary files /dev/null and b/package/appserver/static/img/escu/Slide6.PNG differ diff --git a/package/appserver/static/img/escu/Slide7.PNG b/package/appserver/static/img/escu/Slide7.PNG new file mode 100644 index 0000000000..6f98b937c6 Binary files /dev/null and b/package/appserver/static/img/escu/Slide7.PNG differ diff --git a/package/appserver/static/img/escu/Slide8.PNG b/package/appserver/static/img/escu/Slide8.PNG new file mode 100644 index 0000000000..328fccfbf7 Binary files /dev/null and b/package/appserver/static/img/escu/Slide8.PNG differ diff --git a/package/appserver/static/js/lib/jquery-ui/AUTHORS.txt b/package/appserver/static/js/lib/jquery-ui/AUTHORS.txt new file mode 100644 index 0000000000..a75056b941 --- /dev/null +++ b/package/appserver/static/js/lib/jquery-ui/AUTHORS.txt @@ -0,0 +1,333 @@ +Authors ordered by first contribution +A list of current team members is available at http://jqueryui.com/about + +Paul Bakaus +Richard Worth +Yehuda Katz +Sean Catchpole +John Resig +Tane Piper +Dmitri Gaskin +Klaus Hartl +Stefan Petre +Gilles van den Hoven +Micheil Bryan Smith +Jörn Zaefferer +Marc Grabanski +Keith Wood +Brandon Aaron +Scott González +Eduardo Lundgren +Aaron Eisenberger +Joan Piedra +Bruno Basto +Remy Sharp +Bohdan Ganicky +David Bolter +Chi Cheng +Ca-Phun Ung +Ariel Flesler +Maggie Wachs +Scott Jehl +Todd Parker +Andrew Powell +Brant Burnett +Douglas Neiner +Paul Irish +Ralph Whitbeck +Thibault Duplessis +Dominique Vincent +Jack Hsu +Adam Sontag +Carl Fürstenberg +Kevin Dalman +Alberto Fernández Capel +Jacek Jędrzejewski (http://jacek.jedrzejewski.name) +Ting Kuei +Samuel Cormier-Iijima +Jon Palmer +Ben Hollis +Justin MacCarthy +Eyal Kobrigo +Tiago Freire +Diego Tres +Holger Rüprich +Ziling Zhao +Mike Alsup +Robson Braga Araujo +Pierre-Henri Ausseil +Christopher McCulloh +Andrew Newcomb +Lim Chee Aun +Jorge Barreiro +Daniel Steigerwald +John Firebaugh +John Enters +Andrey Kapitcyn +Dmitry Petrov +Eric Hynds +Chairat Sunthornwiphat +Josh Varner +Stéphane Raimbault +Jay Merrifield +J. Ryan Stinnett +Peter Heiberg +Alex Dovenmuehle +Jamie Gegerson +Raymond Schwartz +Phillip Barnes +Kyle Wilkinson +Khaled AlHourani +Marian Rudzynski +Jean-Francois Remy +Doug Blood +Filippo Cavallarin +Heiko Henning +Aliaksandr Rahalevich +Mario Visic +Xavi Ramirez +Max Schnur +Saji Nediyanchath +Corey Frang +Aaron Peterson +Ivan Peters +Mohamed Cherif Bouchelaghem +Marcos Sousa +Michael DellaNoce +George Marshall +Tobias Brunner +Martin Solli +David Petersen +Dan Heberden +William Kevin Manire +Gilmore Davidson +Michael Wu +Adam Parod +Guillaume Gautreau +Marcel Toele +Dan Streetman +Matt Hoskins +Giovanni Giacobbi +Kyle Florence +Pavol Hluchý +Hans Hillen +Mark Johnson +Trey Hunner +Shane Whittet +Edward A Faulkner +Adam Baratz +Kato Kazuyoshi +Eike Send +Kris Borchers +Eddie Monge +Israel Tsadok +Carson McDonald +Jason Davies +Garrison Locke +David Murdoch +Benjamin Scott Boyle +Jesse Baird +Jonathan Vingiano +Dylan Just +Hiroshi Tomita +Glenn Goodrich +Tarafder Ashek-E-Elahi +Ryan Neufeld +Marc Neuwirth +Philip Graham +Benjamin Sterling +Wesley Walser +Kouhei Sutou +Karl Kirch +Chris Kelly +Jason Oster +Felix Nagel +Alexander Polomoshnov +David Leal +Igor Milla +Dave Methvin +Florian Gutmann +Marwan Al Jubeh +Milan Broum +Sebastian Sauer +Gaëtan Muller +Michel Weimerskirch +William Griffiths +Stojce Slavkovski +David Soms +David De Sloovere +Michael P. Jung +Shannon Pekary +Dan Wellman +Matthew Edward Hutton +James Khoury +Rob Loach +Alberto Monteiro +Alex Rhea +Krzysztof Rosiński +Ryan Olton +Genie <386@mail.com> +Rick Waldron +Ian Simpson +Lev Kitsis +TJ VanToll +Justin Domnitz +Douglas Cerna +Bert ter Heide +Jasvir Nagra +Yuriy Khabarov <13real008@gmail.com> +Harri Kilpiö +Lado Lomidze +Amir E. Aharoni +Simon Sattes +Jo Liss +Guntupalli Karunakar +Shahyar Ghobadpour +Lukasz Lipinski +Timo Tijhof +Jason Moon +Martin Frost +Eneko Illarramendi +EungJun Yi +Courtland Allen +Viktar Varvanovich +Danny Trunk +Pavel Stetina +Michael Stay +Steven Roussey +Michael Hollis +Lee Rowlands +Timmy Willison +Karl Swedberg +Baoju Yuan +Maciej Mroziński +Luis Dalmolin +Mark Aaron Shirley +Martin Hoch +Jiayi Yang +Philipp Benjamin Köppchen +Sindre Sorhus +Bernhard Sirlinger +Jared A. Scheel +Rafael Xavier de Souza +John Chen +Robert Beuligmann +Dale Kocian +Mike Sherov +Andrew Couch +Marc-Andre Lafortune +Nate Eagle +David Souther +Mathias Stenbom +Sergey Kartashov +Avinash R +Ethan Romba +Cory Gackenheimer +Juan Pablo Kaniefsky +Roman Salnikov +Anika Henke +Samuel Bovée +Fabrício Matté +Viktor Kojouharov +Pawel Maruszczyk (http://hrabstwo.net) +Pavel Selitskas +Bjørn Johansen +Matthieu Penant +Dominic Barnes +David Sullivan +Thomas Jaggi +Vahid Sohrabloo +Travis Carden +Bruno M. Custódio +Nathanael Silverman +Christian Wenz +Steve Urmston +Zaven Muradyan +Woody Gilk +Zbigniew Motyka +Suhail Alkowaileet +Toshi MARUYAMA +David Hansen +Brian Grinstead +Christian Klammer +Steven Luscher +Gan Eng Chin +Gabriel Schulhof +Alexander Schmitz +Vilhjálmur Skúlason +Siebrand Mazeland +Mohsen Ekhtiari +Pere Orga +Jasper de Groot +Stephane Deschamps +Jyoti Deka +Andrei Picus +Ondrej Novy +Jacob McCutcheon +Monika Piotrowicz +Imants Horsts +Eric Dahl +Dave Stein +Dylan Barrell +Daniel DeGroff +Michael Wiencek +Thomas Meyer +Ruslan Yakhyaev +Brian J. Dowling +Ben Higgins +Yermo Lamers +Patrick Stapleton +Trisha Crowley +Usman Akeju +Rodrigo Menezes +Jacques Perrault +Frederik Elvhage +Will Holley +Uri Gilad +Richard Gibson +Simen Bekkhus +Chen Eshchar +Bruno Pérel +Mohammed Alshehri +Lisa Seacat DeLuca +Anne-Gaelle Colom +Adam Foster +Luke Page +Daniel Owens +Michael Orchard +Marcus Warren +Nils Heuermann +Marco Ziech +Patricia Juarez +Ben Mosher +Ablay Keldibek +Thomas Applencourt +Jiabao Wu +Eric Lee Carraway +Victor Homyakov +Myeongjin Lee +Liran Sharir +Weston Ruter +Mani Mishra +Hannah Methvin +Leonardo Balter +Benjamin Albert +Michał Gołębiowski +Alyosha Pushak +Fahad Ahmad +Matt Brundage +Francesc Baeta +Piotr Baran +Mukul Hase +Konstantin Dinev +Rand Scullard +Dan Strohl +Maksim Ryzhikov +Amine HADDAD +Amanpreet Singh +Alexey Balchunas +Peter Kehl +Peter Dave Hello +Johannes Schäfer +Ville Skyttä +Ryan Oriecuia diff --git a/package/appserver/static/js/lib/jquery-ui/LICENSE.txt b/package/appserver/static/js/lib/jquery-ui/LICENSE.txt new file mode 100644 index 0000000000..4819e54213 --- /dev/null +++ b/package/appserver/static/js/lib/jquery-ui/LICENSE.txt @@ -0,0 +1,43 @@ +Copyright jQuery Foundation and other contributors, https://jquery.org/ + +This software consists of voluntary contributions made by many +individuals. For exact contribution history, see the revision history +available at https://github.com/jquery/jquery-ui + +The following license applies to all parts of this software except as +documented below: + +==== + +Permission is hereby granted, free of charge, to any person obtaining +a copy of this software and associated documentation files (the +"Software"), to deal in the Software without restriction, including +without limitation the rights to use, copy, modify, merge, publish, +distribute, sublicense, and/or sell copies of the Software, and to +permit persons to whom the Software is furnished to do so, subject to +the following conditions: + +The above copyright notice and this permission notice shall be +included in all copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, +EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF +MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND +NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE +LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION +OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION +WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + +==== + +Copyright and related rights for sample code are waived via CC0. Sample +code is defined as all source code contained within the demos directory. + +CC0: http://creativecommons.org/publicdomain/zero/1.0/ + +==== + +All files located in the node_modules and external directories are +externally maintained libraries used by this software which have their +own licenses; we recommend you read them, as their terms may differ from +the terms above. diff --git a/package/appserver/static/js/lib/jquery-ui/external/jquery/jquery.js b/package/appserver/static/js/lib/jquery-ui/external/jquery/jquery.js new file mode 100644 index 0000000000..50937333b9 --- /dev/null +++ b/package/appserver/static/js/lib/jquery-ui/external/jquery/jquery.js @@ -0,0 +1,10872 @@ +/*! + * jQuery JavaScript Library v3.5.1 + * https://jquery.com/ + * + * Includes Sizzle.js + * https://sizzlejs.com/ + * + * Copyright JS Foundation and other contributors + * Released under the MIT license + * https://jquery.org/license + * + * Date: 2020-05-04T22:49Z + */ +( function( global, factory ) { + + "use strict"; + + if ( typeof module === "object" && typeof module.exports === "object" ) { + + // For CommonJS and CommonJS-like environments where a proper `window` + // is present, execute the factory and get jQuery. + // For environments that do not have a `window` with a `document` + // (such as Node.js), expose a factory as module.exports. + // This accentuates the need for the creation of a real `window`. + // e.g. var jQuery = require("jquery")(window); + // See ticket #14549 for more info. + module.exports = global.document ? + factory( global, true ) : + function( w ) { + if ( !w.document ) { + throw new Error( "jQuery requires a window with a document" ); + } + return factory( w ); + }; + } else { + factory( global ); + } + +// Pass this if window is not defined yet +} )( typeof window !== "undefined" ? window : this, function( window, noGlobal ) { + +// Edge <= 12 - 13+, Firefox <=18 - 45+, IE 10 - 11, Safari 5.1 - 9+, iOS 6 - 9.1 +// throw exceptions when non-strict code (e.g., ASP.NET 4.5) accesses strict mode +// arguments.callee.caller (trac-13335). But as of jQuery 3.0 (2016), strict mode should be common +// enough that all such attempts are guarded in a try block. +"use strict"; + +var arr = []; + +var getProto = Object.getPrototypeOf; + +var slice = arr.slice; + +var flat = arr.flat ? function( array ) { + return arr.flat.call( array ); +} : function( array ) { + return arr.concat.apply( [], array ); +}; + + +var push = arr.push; + +var indexOf = arr.indexOf; + +var class2type = {}; + +var toString = class2type.toString; + +var hasOwn = class2type.hasOwnProperty; + +var fnToString = hasOwn.toString; + +var ObjectFunctionString = fnToString.call( Object ); + +var support = {}; + +var isFunction = function isFunction( obj ) { + + // Support: Chrome <=57, Firefox <=52 + // In some browsers, typeof returns "function" for HTML elements + // (i.e., `typeof document.createElement( "object" ) === "function"`). + // We don't want to classify *any* DOM node as a function. + return typeof obj === "function" && typeof obj.nodeType !== "number"; + }; + + +var isWindow = function isWindow( obj ) { + return obj != null && obj === obj.window; + }; + + +var document = window.document; + + + + var preservedScriptAttributes = { + type: true, + src: true, + nonce: true, + noModule: true + }; + + function DOMEval( code, node, doc ) { + doc = doc || document; + + var i, val, + script = doc.createElement( "script" ); + + script.text = code; + if ( node ) { + for ( i in preservedScriptAttributes ) { + + // Support: Firefox 64+, Edge 18+ + // Some browsers don't support the "nonce" property on scripts. + // On the other hand, just using `getAttribute` is not enough as + // the `nonce` attribute is reset to an empty string whenever it + // becomes browsing-context connected. + // See https://github.com/whatwg/html/issues/2369 + // See https://html.spec.whatwg.org/#nonce-attributes + // The `node.getAttribute` check was added for the sake of + // `jQuery.globalEval` so that it can fake a nonce-containing node + // via an object. + val = node[ i ] || node.getAttribute && node.getAttribute( i ); + if ( val ) { + script.setAttribute( i, val ); + } + } + } + doc.head.appendChild( script ).parentNode.removeChild( script ); + } + + +function toType( obj ) { + if ( obj == null ) { + return obj + ""; + } + + // Support: Android <=2.3 only (functionish RegExp) + return typeof obj === "object" || typeof obj === "function" ? + class2type[ toString.call( obj ) ] || "object" : + typeof obj; +} +/* global Symbol */ +// Defining this global in .eslintrc.json would create a danger of using the global +// unguarded in another place, it seems safer to define global only for this module + + + +var + version = "3.5.1", + + // Define a local copy of jQuery + jQuery = function( selector, context ) { + + // The jQuery object is actually just the init constructor 'enhanced' + // Need init if jQuery is called (just allow error to be thrown if not included) + return new jQuery.fn.init( selector, context ); + }; + +jQuery.fn = jQuery.prototype = { + + // The current version of jQuery being used + jquery: version, + + constructor: jQuery, + + // The default length of a jQuery object is 0 + length: 0, + + toArray: function() { + return slice.call( this ); + }, + + // Get the Nth element in the matched element set OR + // Get the whole matched element set as a clean array + get: function( num ) { + + // Return all the elements in a clean array + if ( num == null ) { + return slice.call( this ); + } + + // Return just the one element from the set + return num < 0 ? this[ num + this.length ] : this[ num ]; + }, + + // Take an array of elements and push it onto the stack + // (returning the new matched element set) + pushStack: function( elems ) { + + // Build a new jQuery matched element set + var ret = jQuery.merge( this.constructor(), elems ); + + // Add the old object onto the stack (as a reference) + ret.prevObject = this; + + // Return the newly-formed element set + return ret; + }, + + // Execute a callback for every element in the matched set. + each: function( callback ) { + return jQuery.each( this, callback ); + }, + + map: function( callback ) { + return this.pushStack( jQuery.map( this, function( elem, i ) { + return callback.call( elem, i, elem ); + } ) ); + }, + + slice: function() { + return this.pushStack( slice.apply( this, arguments ) ); + }, + + first: function() { + return this.eq( 0 ); + }, + + last: function() { + return this.eq( -1 ); + }, + + even: function() { + return this.pushStack( jQuery.grep( this, function( _elem, i ) { + return ( i + 1 ) % 2; + } ) ); + }, + + odd: function() { + return this.pushStack( jQuery.grep( this, function( _elem, i ) { + return i % 2; + } ) ); + }, + + eq: function( i ) { + var len = this.length, + j = +i + ( i < 0 ? len : 0 ); + return this.pushStack( j >= 0 && j < len ? [ this[ j ] ] : [] ); + }, + + end: function() { + return this.prevObject || this.constructor(); + }, + + // For internal use only. + // Behaves like an Array's method, not like a jQuery method. + push: push, + sort: arr.sort, + splice: arr.splice +}; + +jQuery.extend = jQuery.fn.extend = function() { + var options, name, src, copy, copyIsArray, clone, + target = arguments[ 0 ] || {}, + i = 1, + length = arguments.length, + deep = false; + + // Handle a deep copy situation + if ( typeof target === "boolean" ) { + deep = target; + + // Skip the boolean and the target + target = arguments[ i ] || {}; + i++; + } + + // Handle case when target is a string or something (possible in deep copy) + if ( typeof target !== "object" && !isFunction( target ) ) { + target = {}; + } + + // Extend jQuery itself if only one argument is passed + if ( i === length ) { + target = this; + i--; + } + + for ( ; i < length; i++ ) { + + // Only deal with non-null/undefined values + if ( ( options = arguments[ i ] ) != null ) { + + // Extend the base object + for ( name in options ) { + copy = options[ name ]; + + // Prevent Object.prototype pollution + // Prevent never-ending loop + if ( name === "__proto__" || target === copy ) { + continue; + } + + // Recurse if we're merging plain objects or arrays + if ( deep && copy && ( jQuery.isPlainObject( copy ) || + ( copyIsArray = Array.isArray( copy ) ) ) ) { + src = target[ name ]; + + // Ensure proper type for the source value + if ( copyIsArray && !Array.isArray( src ) ) { + clone = []; + } else if ( !copyIsArray && !jQuery.isPlainObject( src ) ) { + clone = {}; + } else { + clone = src; + } + copyIsArray = false; + + // Never move original objects, clone them + target[ name ] = jQuery.extend( deep, clone, copy ); + + // Don't bring in undefined values + } else if ( copy !== undefined ) { + target[ name ] = copy; + } + } + } + } + + // Return the modified object + return target; +}; + +jQuery.extend( { + + // Unique for each copy of jQuery on the page + expando: "jQuery" + ( version + Math.random() ).replace( /\D/g, "" ), + + // Assume jQuery is ready without the ready module + isReady: true, + + error: function( msg ) { + throw new Error( msg ); + }, + + noop: function() {}, + + isPlainObject: function( obj ) { + var proto, Ctor; + + // Detect obvious negatives + // Use toString instead of jQuery.type to catch host objects + if ( !obj || toString.call( obj ) !== "[object Object]" ) { + return false; + } + + proto = getProto( obj ); + + // Objects with no prototype (e.g., `Object.create( null )`) are plain + if ( !proto ) { + return true; + } + + // Objects with prototype are plain iff they were constructed by a global Object function + Ctor = hasOwn.call( proto, "constructor" ) && proto.constructor; + return typeof Ctor === "function" && fnToString.call( Ctor ) === ObjectFunctionString; + }, + + isEmptyObject: function( obj ) { + var name; + + for ( name in obj ) { + return false; + } + return true; + }, + + // Evaluates a script in a provided context; falls back to the global one + // if not specified. + globalEval: function( code, options, doc ) { + DOMEval( code, { nonce: options && options.nonce }, doc ); + }, + + each: function( obj, callback ) { + var length, i = 0; + + if ( isArrayLike( obj ) ) { + length = obj.length; + for ( ; i < length; i++ ) { + if ( callback.call( obj[ i ], i, obj[ i ] ) === false ) { + break; + } + } + } else { + for ( i in obj ) { + if ( callback.call( obj[ i ], i, obj[ i ] ) === false ) { + break; + } + } + } + + return obj; + }, + + // results is for internal usage only + makeArray: function( arr, results ) { + var ret = results || []; + + if ( arr != null ) { + if ( isArrayLike( Object( arr ) ) ) { + jQuery.merge( ret, + typeof arr === "string" ? + [ arr ] : arr + ); + } else { + push.call( ret, arr ); + } + } + + return ret; + }, + + inArray: function( elem, arr, i ) { + return arr == null ? -1 : indexOf.call( arr, elem, i ); + }, + + // Support: Android <=4.0 only, PhantomJS 1 only + // push.apply(_, arraylike) throws on ancient WebKit + merge: function( first, second ) { + var len = +second.length, + j = 0, + i = first.length; + + for ( ; j < len; j++ ) { + first[ i++ ] = second[ j ]; + } + + first.length = i; + + return first; + }, + + grep: function( elems, callback, invert ) { + var callbackInverse, + matches = [], + i = 0, + length = elems.length, + callbackExpect = !invert; + + // Go through the array, only saving the items + // that pass the validator function + for ( ; i < length; i++ ) { + callbackInverse = !callback( elems[ i ], i ); + if ( callbackInverse !== callbackExpect ) { + matches.push( elems[ i ] ); + } + } + + return matches; + }, + + // arg is for internal usage only + map: function( elems, callback, arg ) { + var length, value, + i = 0, + ret = []; + + // Go through the array, translating each of the items to their new values + if ( isArrayLike( elems ) ) { + length = elems.length; + for ( ; i < length; i++ ) { + value = callback( elems[ i ], i, arg ); + + if ( value != null ) { + ret.push( value ); + } + } + + // Go through every key on the object, + } else { + for ( i in elems ) { + value = callback( elems[ i ], i, arg ); + + if ( value != null ) { + ret.push( value ); + } + } + } + + // Flatten any nested arrays + return flat( ret ); + }, + + // A global GUID counter for objects + guid: 1, + + // jQuery.support is not used in Core but other projects attach their + // properties to it so it needs to exist. + support: support +} ); + +if ( typeof Symbol === "function" ) { + jQuery.fn[ Symbol.iterator ] = arr[ Symbol.iterator ]; +} + +// Populate the class2type map +jQuery.each( "Boolean Number String Function Array Date RegExp Object Error Symbol".split( " " ), +function( _i, name ) { + class2type[ "[object " + name + "]" ] = name.toLowerCase(); +} ); + +function isArrayLike( obj ) { + + // Support: real iOS 8.2 only (not reproducible in simulator) + // `in` check used to prevent JIT error (gh-2145) + // hasOwn isn't used here due to false negatives + // regarding Nodelist length in IE + var length = !!obj && "length" in obj && obj.length, + type = toType( obj ); + + if ( isFunction( obj ) || isWindow( obj ) ) { + return false; + } + + return type === "array" || length === 0 || + typeof length === "number" && length > 0 && ( length - 1 ) in obj; +} +var Sizzle = +/*! + * Sizzle CSS Selector Engine v2.3.5 + * https://sizzlejs.com/ + * + * Copyright JS Foundation and other contributors + * Released under the MIT license + * https://js.foundation/ + * + * Date: 2020-03-14 + */ +( function( window ) { +var i, + support, + Expr, + getText, + isXML, + tokenize, + compile, + select, + outermostContext, + sortInput, + hasDuplicate, + + // Local document vars + setDocument, + document, + docElem, + documentIsHTML, + rbuggyQSA, + rbuggyMatches, + matches, + contains, + + // Instance-specific data + expando = "sizzle" + 1 * new Date(), + preferredDoc = window.document, + dirruns = 0, + done = 0, + classCache = createCache(), + tokenCache = createCache(), + compilerCache = createCache(), + nonnativeSelectorCache = createCache(), + sortOrder = function( a, b ) { + if ( a === b ) { + hasDuplicate = true; + } + return 0; + }, + + // Instance methods + hasOwn = ( {} ).hasOwnProperty, + arr = [], + pop = arr.pop, + pushNative = arr.push, + push = arr.push, + slice = arr.slice, + + // Use a stripped-down indexOf as it's faster than native + // https://jsperf.com/thor-indexof-vs-for/5 + indexOf = function( list, elem ) { + var i = 0, + len = list.length; + for ( ; i < len; i++ ) { + if ( list[ i ] === elem ) { + return i; + } + } + return -1; + }, + + booleans = "checked|selected|async|autofocus|autoplay|controls|defer|disabled|hidden|" + + "ismap|loop|multiple|open|readonly|required|scoped", + + // Regular expressions + + // http://www.w3.org/TR/css3-selectors/#whitespace + whitespace = "[\\x20\\t\\r\\n\\f]", + + // https://www.w3.org/TR/css-syntax-3/#ident-token-diagram + identifier = "(?:\\\\[\\da-fA-F]{1,6}" + whitespace + + "?|\\\\[^\\r\\n\\f]|[\\w-]|[^\0-\\x7f])+", + + // Attribute selectors: http://www.w3.org/TR/selectors/#attribute-selectors + attributes = "\\[" + whitespace + "*(" + identifier + ")(?:" + whitespace + + + // Operator (capture 2) + "*([*^$|!~]?=)" + whitespace + + + // "Attribute values must be CSS identifiers [capture 5] + // or strings [capture 3 or capture 4]" + "*(?:'((?:\\\\.|[^\\\\'])*)'|\"((?:\\\\.|[^\\\\\"])*)\"|(" + identifier + "))|)" + + whitespace + "*\\]", + + pseudos = ":(" + identifier + ")(?:\\((" + + + // To reduce the number of selectors needing tokenize in the preFilter, prefer arguments: + // 1. quoted (capture 3; capture 4 or capture 5) + "('((?:\\\\.|[^\\\\'])*)'|\"((?:\\\\.|[^\\\\\"])*)\")|" + + + // 2. simple (capture 6) + "((?:\\\\.|[^\\\\()[\\]]|" + attributes + ")*)|" + + + // 3. anything else (capture 2) + ".*" + + ")\\)|)", + + // Leading and non-escaped trailing whitespace, capturing some non-whitespace characters preceding the latter + rwhitespace = new RegExp( whitespace + "+", "g" ), + rtrim = new RegExp( "^" + whitespace + "+|((?:^|[^\\\\])(?:\\\\.)*)" + + whitespace + "+$", "g" ), + + rcomma = new RegExp( "^" + whitespace + "*," + whitespace + "*" ), + rcombinators = new RegExp( "^" + whitespace + "*([>+~]|" + whitespace + ")" + whitespace + + "*" ), + rdescend = new RegExp( whitespace + "|>" ), + + rpseudo = new RegExp( pseudos ), + ridentifier = new RegExp( "^" + identifier + "$" ), + + matchExpr = { + "ID": new RegExp( "^#(" + identifier + ")" ), + "CLASS": new RegExp( "^\\.(" + identifier + ")" ), + "TAG": new RegExp( "^(" + identifier + "|[*])" ), + "ATTR": new RegExp( "^" + attributes ), + "PSEUDO": new RegExp( "^" + pseudos ), + "CHILD": new RegExp( "^:(only|first|last|nth|nth-last)-(child|of-type)(?:\\(" + + whitespace + "*(even|odd|(([+-]|)(\\d*)n|)" + whitespace + "*(?:([+-]|)" + + whitespace + "*(\\d+)|))" + whitespace + "*\\)|)", "i" ), + "bool": new RegExp( "^(?:" + booleans + ")$", "i" ), + + // For use in libraries implementing .is() + // We use this for POS matching in `select` + "needsContext": new RegExp( "^" + whitespace + + "*[>+~]|:(even|odd|eq|gt|lt|nth|first|last)(?:\\(" + whitespace + + "*((?:-\\d)?\\d*)" + whitespace + "*\\)|)(?=[^-]|$)", "i" ) + }, + + rhtml = /HTML$/i, + rinputs = /^(?:input|select|textarea|button)$/i, + rheader = /^h\d$/i, + + rnative = /^[^{]+\{\s*\[native \w/, + + // Easily-parseable/retrievable ID or TAG or CLASS selectors + rquickExpr = /^(?:#([\w-]+)|(\w+)|\.([\w-]+))$/, + + rsibling = /[+~]/, + + // CSS escapes + // http://www.w3.org/TR/CSS21/syndata.html#escaped-characters + runescape = new RegExp( "\\\\[\\da-fA-F]{1,6}" + whitespace + "?|\\\\([^\\r\\n\\f])", "g" ), + funescape = function( escape, nonHex ) { + var high = "0x" + escape.slice( 1 ) - 0x10000; + + return nonHex ? + + // Strip the backslash prefix from a non-hex escape sequence + nonHex : + + // Replace a hexadecimal escape sequence with the encoded Unicode code point + // Support: IE <=11+ + // For values outside the Basic Multilingual Plane (BMP), manually construct a + // surrogate pair + high < 0 ? + String.fromCharCode( high + 0x10000 ) : + String.fromCharCode( high >> 10 | 0xD800, high & 0x3FF | 0xDC00 ); + }, + + // CSS string/identifier serialization + // https://drafts.csswg.org/cssom/#common-serializing-idioms + rcssescape = /([\0-\x1f\x7f]|^-?\d)|^-$|[^\0-\x1f\x7f-\uFFFF\w-]/g, + fcssescape = function( ch, asCodePoint ) { + if ( asCodePoint ) { + + // U+0000 NULL becomes U+FFFD REPLACEMENT CHARACTER + if ( ch === "\0" ) { + return "\uFFFD"; + } + + // Control characters and (dependent upon position) numbers get escaped as code points + return ch.slice( 0, -1 ) + "\\" + + ch.charCodeAt( ch.length - 1 ).toString( 16 ) + " "; + } + + // Other potentially-special ASCII characters get backslash-escaped + return "\\" + ch; + }, + + // Used for iframes + // See setDocument() + // Removing the function wrapper causes a "Permission Denied" + // error in IE + unloadHandler = function() { + setDocument(); + }, + + inDisabledFieldset = addCombinator( + function( elem ) { + return elem.disabled === true && elem.nodeName.toLowerCase() === "fieldset"; + }, + { dir: "parentNode", next: "legend" } + ); + +// Optimize for push.apply( _, NodeList ) +try { + push.apply( + ( arr = slice.call( preferredDoc.childNodes ) ), + preferredDoc.childNodes + ); + + // Support: Android<4.0 + // Detect silently failing push.apply + // eslint-disable-next-line no-unused-expressions + arr[ preferredDoc.childNodes.length ].nodeType; +} catch ( e ) { + push = { apply: arr.length ? + + // Leverage slice if possible + function( target, els ) { + pushNative.apply( target, slice.call( els ) ); + } : + + // Support: IE<9 + // Otherwise append directly + function( target, els ) { + var j = target.length, + i = 0; + + // Can't trust NodeList.length + while ( ( target[ j++ ] = els[ i++ ] ) ) {} + target.length = j - 1; + } + }; +} + +function Sizzle( selector, context, results, seed ) { + var m, i, elem, nid, match, groups, newSelector, + newContext = context && context.ownerDocument, + + // nodeType defaults to 9, since context defaults to document + nodeType = context ? context.nodeType : 9; + + results = results || []; + + // Return early from calls with invalid selector or context + if ( typeof selector !== "string" || !selector || + nodeType !== 1 && nodeType !== 9 && nodeType !== 11 ) { + + return results; + } + + // Try to shortcut find operations (as opposed to filters) in HTML documents + if ( !seed ) { + setDocument( context ); + context = context || document; + + if ( documentIsHTML ) { + + // If the selector is sufficiently simple, try using a "get*By*" DOM method + // (excepting DocumentFragment context, where the methods don't exist) + if ( nodeType !== 11 && ( match = rquickExpr.exec( selector ) ) ) { + + // ID selector + if ( ( m = match[ 1 ] ) ) { + + // Document context + if ( nodeType === 9 ) { + if ( ( elem = context.getElementById( m ) ) ) { + + // Support: IE, Opera, Webkit + // TODO: identify versions + // getElementById can match elements by name instead of ID + if ( elem.id === m ) { + results.push( elem ); + return results; + } + } else { + return results; + } + + // Element context + } else { + + // Support: IE, Opera, Webkit + // TODO: identify versions + // getElementById can match elements by name instead of ID + if ( newContext && ( elem = newContext.getElementById( m ) ) && + contains( context, elem ) && + elem.id === m ) { + + results.push( elem ); + return results; + } + } + + // Type selector + } else if ( match[ 2 ] ) { + push.apply( results, context.getElementsByTagName( selector ) ); + return results; + + // Class selector + } else if ( ( m = match[ 3 ] ) && support.getElementsByClassName && + context.getElementsByClassName ) { + + push.apply( results, context.getElementsByClassName( m ) ); + return results; + } + } + + // Take advantage of querySelectorAll + if ( support.qsa && + !nonnativeSelectorCache[ selector + " " ] && + ( !rbuggyQSA || !rbuggyQSA.test( selector ) ) && + + // Support: IE 8 only + // Exclude object elements + ( nodeType !== 1 || context.nodeName.toLowerCase() !== "object" ) ) { + + newSelector = selector; + newContext = context; + + // qSA considers elements outside a scoping root when evaluating child or + // descendant combinators, which is not what we want. + // In such cases, we work around the behavior by prefixing every selector in the + // list with an ID selector referencing the scope context. + // The technique has to be used as well when a leading combinator is used + // as such selectors are not recognized by querySelectorAll. + // Thanks to Andrew Dupont for this technique. + if ( nodeType === 1 && + ( rdescend.test( selector ) || rcombinators.test( selector ) ) ) { + + // Expand context for sibling selectors + newContext = rsibling.test( selector ) && testContext( context.parentNode ) || + context; + + // We can use :scope instead of the ID hack if the browser + // supports it & if we're not changing the context. + if ( newContext !== context || !support.scope ) { + + // Capture the context ID, setting it first if necessary + if ( ( nid = context.getAttribute( "id" ) ) ) { + nid = nid.replace( rcssescape, fcssescape ); + } else { + context.setAttribute( "id", ( nid = expando ) ); + } + } + + // Prefix every selector in the list + groups = tokenize( selector ); + i = groups.length; + while ( i-- ) { + groups[ i ] = ( nid ? "#" + nid : ":scope" ) + " " + + toSelector( groups[ i ] ); + } + newSelector = groups.join( "," ); + } + + try { + push.apply( results, + newContext.querySelectorAll( newSelector ) + ); + return results; + } catch ( qsaError ) { + nonnativeSelectorCache( selector, true ); + } finally { + if ( nid === expando ) { + context.removeAttribute( "id" ); + } + } + } + } + } + + // All others + return select( selector.replace( rtrim, "$1" ), context, results, seed ); +} + +/** + * Create key-value caches of limited size + * @returns {function(string, object)} Returns the Object data after storing it on itself with + * property name the (space-suffixed) string and (if the cache is larger than Expr.cacheLength) + * deleting the oldest entry + */ +function createCache() { + var keys = []; + + function cache( key, value ) { + + // Use (key + " ") to avoid collision with native prototype properties (see Issue #157) + if ( keys.push( key + " " ) > Expr.cacheLength ) { + + // Only keep the most recent entries + delete cache[ keys.shift() ]; + } + return ( cache[ key + " " ] = value ); + } + return cache; +} + +/** + * Mark a function for special use by Sizzle + * @param {Function} fn The function to mark + */ +function markFunction( fn ) { + fn[ expando ] = true; + return fn; +} + +/** + * Support testing using an element + * @param {Function} fn Passed the created element and returns a boolean result + */ +function assert( fn ) { + var el = document.createElement( "fieldset" ); + + try { + return !!fn( el ); + } catch ( e ) { + return false; + } finally { + + // Remove from its parent by default + if ( el.parentNode ) { + el.parentNode.removeChild( el ); + } + + // release memory in IE + el = null; + } +} + +/** + * Adds the same handler for all of the specified attrs + * @param {String} attrs Pipe-separated list of attributes + * @param {Function} handler The method that will be applied + */ +function addHandle( attrs, handler ) { + var arr = attrs.split( "|" ), + i = arr.length; + + while ( i-- ) { + Expr.attrHandle[ arr[ i ] ] = handler; + } +} + +/** + * Checks document order of two siblings + * @param {Element} a + * @param {Element} b + * @returns {Number} Returns less than 0 if a precedes b, greater than 0 if a follows b + */ +function siblingCheck( a, b ) { + var cur = b && a, + diff = cur && a.nodeType === 1 && b.nodeType === 1 && + a.sourceIndex - b.sourceIndex; + + // Use IE sourceIndex if available on both nodes + if ( diff ) { + return diff; + } + + // Check if b follows a + if ( cur ) { + while ( ( cur = cur.nextSibling ) ) { + if ( cur === b ) { + return -1; + } + } + } + + return a ? 1 : -1; +} + +/** + * Returns a function to use in pseudos for input types + * @param {String} type + */ +function createInputPseudo( type ) { + return function( elem ) { + var name = elem.nodeName.toLowerCase(); + return name === "input" && elem.type === type; + }; +} + +/** + * Returns a function to use in pseudos for buttons + * @param {String} type + */ +function createButtonPseudo( type ) { + return function( elem ) { + var name = elem.nodeName.toLowerCase(); + return ( name === "input" || name === "button" ) && elem.type === type; + }; +} + +/** + * Returns a function to use in pseudos for :enabled/:disabled + * @param {Boolean} disabled true for :disabled; false for :enabled + */ +function createDisabledPseudo( disabled ) { + + // Known :disabled false positives: fieldset[disabled] > legend:nth-of-type(n+2) :can-disable + return function( elem ) { + + // Only certain elements can match :enabled or :disabled + // https://html.spec.whatwg.org/multipage/scripting.html#selector-enabled + // https://html.spec.whatwg.org/multipage/scripting.html#selector-disabled + if ( "form" in elem ) { + + // Check for inherited disabledness on relevant non-disabled elements: + // * listed form-associated elements in a disabled fieldset + // https://html.spec.whatwg.org/multipage/forms.html#category-listed + // https://html.spec.whatwg.org/multipage/forms.html#concept-fe-disabled + // * option elements in a disabled optgroup + // https://html.spec.whatwg.org/multipage/forms.html#concept-option-disabled + // All such elements have a "form" property. + if ( elem.parentNode && elem.disabled === false ) { + + // Option elements defer to a parent optgroup if present + if ( "label" in elem ) { + if ( "label" in elem.parentNode ) { + return elem.parentNode.disabled === disabled; + } else { + return elem.disabled === disabled; + } + } + + // Support: IE 6 - 11 + // Use the isDisabled shortcut property to check for disabled fieldset ancestors + return elem.isDisabled === disabled || + + // Where there is no isDisabled, check manually + /* jshint -W018 */ + elem.isDisabled !== !disabled && + inDisabledFieldset( elem ) === disabled; + } + + return elem.disabled === disabled; + + // Try to winnow out elements that can't be disabled before trusting the disabled property. + // Some victims get caught in our net (label, legend, menu, track), but it shouldn't + // even exist on them, let alone have a boolean value. + } else if ( "label" in elem ) { + return elem.disabled === disabled; + } + + // Remaining elements are neither :enabled nor :disabled + return false; + }; +} + +/** + * Returns a function to use in pseudos for positionals + * @param {Function} fn + */ +function createPositionalPseudo( fn ) { + return markFunction( function( argument ) { + argument = +argument; + return markFunction( function( seed, matches ) { + var j, + matchIndexes = fn( [], seed.length, argument ), + i = matchIndexes.length; + + // Match elements found at the specified indexes + while ( i-- ) { + if ( seed[ ( j = matchIndexes[ i ] ) ] ) { + seed[ j ] = !( matches[ j ] = seed[ j ] ); + } + } + } ); + } ); +} + +/** + * Checks a node for validity as a Sizzle context + * @param {Element|Object=} context + * @returns {Element|Object|Boolean} The input node if acceptable, otherwise a falsy value + */ +function testContext( context ) { + return context && typeof context.getElementsByTagName !== "undefined" && context; +} + +// Expose support vars for convenience +support = Sizzle.support = {}; + +/** + * Detects XML nodes + * @param {Element|Object} elem An element or a document + * @returns {Boolean} True iff elem is a non-HTML XML node + */ +isXML = Sizzle.isXML = function( elem ) { + var namespace = elem.namespaceURI, + docElem = ( elem.ownerDocument || elem ).documentElement; + + // Support: IE <=8 + // Assume HTML when documentElement doesn't yet exist, such as inside loading iframes + // https://bugs.jquery.com/ticket/4833 + return !rhtml.test( namespace || docElem && docElem.nodeName || "HTML" ); +}; + +/** + * Sets document-related variables once based on the current document + * @param {Element|Object} [doc] An element or document object to use to set the document + * @returns {Object} Returns the current document + */ +setDocument = Sizzle.setDocument = function( node ) { + var hasCompare, subWindow, + doc = node ? node.ownerDocument || node : preferredDoc; + + // Return early if doc is invalid or already selected + // Support: IE 11+, Edge 17 - 18+ + // IE/Edge sometimes throw a "Permission denied" error when strict-comparing + // two documents; shallow comparisons work. + // eslint-disable-next-line eqeqeq + if ( doc == document || doc.nodeType !== 9 || !doc.documentElement ) { + return document; + } + + // Update global variables + document = doc; + docElem = document.documentElement; + documentIsHTML = !isXML( document ); + + // Support: IE 9 - 11+, Edge 12 - 18+ + // Accessing iframe documents after unload throws "permission denied" errors (jQuery #13936) + // Support: IE 11+, Edge 17 - 18+ + // IE/Edge sometimes throw a "Permission denied" error when strict-comparing + // two documents; shallow comparisons work. + // eslint-disable-next-line eqeqeq + if ( preferredDoc != document && + ( subWindow = document.defaultView ) && subWindow.top !== subWindow ) { + + // Support: IE 11, Edge + if ( subWindow.addEventListener ) { + subWindow.addEventListener( "unload", unloadHandler, false ); + + // Support: IE 9 - 10 only + } else if ( subWindow.attachEvent ) { + subWindow.attachEvent( "onunload", unloadHandler ); + } + } + + // Support: IE 8 - 11+, Edge 12 - 18+, Chrome <=16 - 25 only, Firefox <=3.6 - 31 only, + // Safari 4 - 5 only, Opera <=11.6 - 12.x only + // IE/Edge & older browsers don't support the :scope pseudo-class. + // Support: Safari 6.0 only + // Safari 6.0 supports :scope but it's an alias of :root there. + support.scope = assert( function( el ) { + docElem.appendChild( el ).appendChild( document.createElement( "div" ) ); + return typeof el.querySelectorAll !== "undefined" && + !el.querySelectorAll( ":scope fieldset div" ).length; + } ); + + /* Attributes + ---------------------------------------------------------------------- */ + + // Support: IE<8 + // Verify that getAttribute really returns attributes and not properties + // (excepting IE8 booleans) + support.attributes = assert( function( el ) { + el.className = "i"; + return !el.getAttribute( "className" ); + } ); + + /* getElement(s)By* + ---------------------------------------------------------------------- */ + + // Check if getElementsByTagName("*") returns only elements + support.getElementsByTagName = assert( function( el ) { + el.appendChild( document.createComment( "" ) ); + return !el.getElementsByTagName( "*" ).length; + } ); + + // Support: IE<9 + support.getElementsByClassName = rnative.test( document.getElementsByClassName ); + + // Support: IE<10 + // Check if getElementById returns elements by name + // The broken getElementById methods don't pick up programmatically-set names, + // so use a roundabout getElementsByName test + support.getById = assert( function( el ) { + docElem.appendChild( el ).id = expando; + return !document.getElementsByName || !document.getElementsByName( expando ).length; + } ); + + // ID filter and find + if ( support.getById ) { + Expr.filter[ "ID" ] = function( id ) { + var attrId = id.replace( runescape, funescape ); + return function( elem ) { + return elem.getAttribute( "id" ) === attrId; + }; + }; + Expr.find[ "ID" ] = function( id, context ) { + if ( typeof context.getElementById !== "undefined" && documentIsHTML ) { + var elem = context.getElementById( id ); + return elem ? [ elem ] : []; + } + }; + } else { + Expr.filter[ "ID" ] = function( id ) { + var attrId = id.replace( runescape, funescape ); + return function( elem ) { + var node = typeof elem.getAttributeNode !== "undefined" && + elem.getAttributeNode( "id" ); + return node && node.value === attrId; + }; + }; + + // Support: IE 6 - 7 only + // getElementById is not reliable as a find shortcut + Expr.find[ "ID" ] = function( id, context ) { + if ( typeof context.getElementById !== "undefined" && documentIsHTML ) { + var node, i, elems, + elem = context.getElementById( id ); + + if ( elem ) { + + // Verify the id attribute + node = elem.getAttributeNode( "id" ); + if ( node && node.value === id ) { + return [ elem ]; + } + + // Fall back on getElementsByName + elems = context.getElementsByName( id ); + i = 0; + while ( ( elem = elems[ i++ ] ) ) { + node = elem.getAttributeNode( "id" ); + if ( node && node.value === id ) { + return [ elem ]; + } + } + } + + return []; + } + }; + } + + // Tag + Expr.find[ "TAG" ] = support.getElementsByTagName ? + function( tag, context ) { + if ( typeof context.getElementsByTagName !== "undefined" ) { + return context.getElementsByTagName( tag ); + + // DocumentFragment nodes don't have gEBTN + } else if ( support.qsa ) { + return context.querySelectorAll( tag ); + } + } : + + function( tag, context ) { + var elem, + tmp = [], + i = 0, + + // By happy coincidence, a (broken) gEBTN appears on DocumentFragment nodes too + results = context.getElementsByTagName( tag ); + + // Filter out possible comments + if ( tag === "*" ) { + while ( ( elem = results[ i++ ] ) ) { + if ( elem.nodeType === 1 ) { + tmp.push( elem ); + } + } + + return tmp; + } + return results; + }; + + // Class + Expr.find[ "CLASS" ] = support.getElementsByClassName && function( className, context ) { + if ( typeof context.getElementsByClassName !== "undefined" && documentIsHTML ) { + return context.getElementsByClassName( className ); + } + }; + + /* QSA/matchesSelector + ---------------------------------------------------------------------- */ + + // QSA and matchesSelector support + + // matchesSelector(:active) reports false when true (IE9/Opera 11.5) + rbuggyMatches = []; + + // qSa(:focus) reports false when true (Chrome 21) + // We allow this because of a bug in IE8/9 that throws an error + // whenever `document.activeElement` is accessed on an iframe + // So, we allow :focus to pass through QSA all the time to avoid the IE error + // See https://bugs.jquery.com/ticket/13378 + rbuggyQSA = []; + + if ( ( support.qsa = rnative.test( document.querySelectorAll ) ) ) { + + // Build QSA regex + // Regex strategy adopted from Diego Perini + assert( function( el ) { + + var input; + + // Select is set to empty string on purpose + // This is to test IE's treatment of not explicitly + // setting a boolean content attribute, + // since its presence should be enough + // https://bugs.jquery.com/ticket/12359 + docElem.appendChild( el ).innerHTML = "" + + ""; + + // Support: IE8, Opera 11-12.16 + // Nothing should be selected when empty strings follow ^= or $= or *= + // The test attribute must be unknown in Opera but "safe" for WinRT + // https://msdn.microsoft.com/en-us/library/ie/hh465388.aspx#attribute_section + if ( el.querySelectorAll( "[msallowcapture^='']" ).length ) { + rbuggyQSA.push( "[*^$]=" + whitespace + "*(?:''|\"\")" ); + } + + // Support: IE8 + // Boolean attributes and "value" are not treated correctly + if ( !el.querySelectorAll( "[selected]" ).length ) { + rbuggyQSA.push( "\\[" + whitespace + "*(?:value|" + booleans + ")" ); + } + + // Support: Chrome<29, Android<4.4, Safari<7.0+, iOS<7.0+, PhantomJS<1.9.8+ + if ( !el.querySelectorAll( "[id~=" + expando + "-]" ).length ) { + rbuggyQSA.push( "~=" ); + } + + // Support: IE 11+, Edge 15 - 18+ + // IE 11/Edge don't find elements on a `[name='']` query in some cases. + // Adding a temporary attribute to the document before the selection works + // around the issue. + // Interestingly, IE 10 & older don't seem to have the issue. + input = document.createElement( "input" ); + input.setAttribute( "name", "" ); + el.appendChild( input ); + if ( !el.querySelectorAll( "[name='']" ).length ) { + rbuggyQSA.push( "\\[" + whitespace + "*name" + whitespace + "*=" + + whitespace + "*(?:''|\"\")" ); + } + + // Webkit/Opera - :checked should return selected option elements + // http://www.w3.org/TR/2011/REC-css3-selectors-20110929/#checked + // IE8 throws error here and will not see later tests + if ( !el.querySelectorAll( ":checked" ).length ) { + rbuggyQSA.push( ":checked" ); + } + + // Support: Safari 8+, iOS 8+ + // https://bugs.webkit.org/show_bug.cgi?id=136851 + // In-page `selector#id sibling-combinator selector` fails + if ( !el.querySelectorAll( "a#" + expando + "+*" ).length ) { + rbuggyQSA.push( ".#.+[+~]" ); + } + + // Support: Firefox <=3.6 - 5 only + // Old Firefox doesn't throw on a badly-escaped identifier. + el.querySelectorAll( "\\\f" ); + rbuggyQSA.push( "[\\r\\n\\f]" ); + } ); + + assert( function( el ) { + el.innerHTML = "" + + ""; + + // Support: Windows 8 Native Apps + // The type and name attributes are restricted during .innerHTML assignment + var input = document.createElement( "input" ); + input.setAttribute( "type", "hidden" ); + el.appendChild( input ).setAttribute( "name", "D" ); + + // Support: IE8 + // Enforce case-sensitivity of name attribute + if ( el.querySelectorAll( "[name=d]" ).length ) { + rbuggyQSA.push( "name" + whitespace + "*[*^$|!~]?=" ); + } + + // FF 3.5 - :enabled/:disabled and hidden elements (hidden elements are still enabled) + // IE8 throws error here and will not see later tests + if ( el.querySelectorAll( ":enabled" ).length !== 2 ) { + rbuggyQSA.push( ":enabled", ":disabled" ); + } + + // Support: IE9-11+ + // IE's :disabled selector does not pick up the children of disabled fieldsets + docElem.appendChild( el ).disabled = true; + if ( el.querySelectorAll( ":disabled" ).length !== 2 ) { + rbuggyQSA.push( ":enabled", ":disabled" ); + } + + // Support: Opera 10 - 11 only + // Opera 10-11 does not throw on post-comma invalid pseudos + el.querySelectorAll( "*,:x" ); + rbuggyQSA.push( ",.*:" ); + } ); + } + + if ( ( support.matchesSelector = rnative.test( ( matches = docElem.matches || + docElem.webkitMatchesSelector || + docElem.mozMatchesSelector || + docElem.oMatchesSelector || + docElem.msMatchesSelector ) ) ) ) { + + assert( function( el ) { + + // Check to see if it's possible to do matchesSelector + // on a disconnected node (IE 9) + support.disconnectedMatch = matches.call( el, "*" ); + + // This should fail with an exception + // Gecko does not error, returns false instead + matches.call( el, "[s!='']:x" ); + rbuggyMatches.push( "!=", pseudos ); + } ); + } + + rbuggyQSA = rbuggyQSA.length && new RegExp( rbuggyQSA.join( "|" ) ); + rbuggyMatches = rbuggyMatches.length && new RegExp( rbuggyMatches.join( "|" ) ); + + /* Contains + ---------------------------------------------------------------------- */ + hasCompare = rnative.test( docElem.compareDocumentPosition ); + + // Element contains another + // Purposefully self-exclusive + // As in, an element does not contain itself + contains = hasCompare || rnative.test( docElem.contains ) ? + function( a, b ) { + var adown = a.nodeType === 9 ? a.documentElement : a, + bup = b && b.parentNode; + return a === bup || !!( bup && bup.nodeType === 1 && ( + adown.contains ? + adown.contains( bup ) : + a.compareDocumentPosition && a.compareDocumentPosition( bup ) & 16 + ) ); + } : + function( a, b ) { + if ( b ) { + while ( ( b = b.parentNode ) ) { + if ( b === a ) { + return true; + } + } + } + return false; + }; + + /* Sorting + ---------------------------------------------------------------------- */ + + // Document order sorting + sortOrder = hasCompare ? + function( a, b ) { + + // Flag for duplicate removal + if ( a === b ) { + hasDuplicate = true; + return 0; + } + + // Sort on method existence if only one input has compareDocumentPosition + var compare = !a.compareDocumentPosition - !b.compareDocumentPosition; + if ( compare ) { + return compare; + } + + // Calculate position if both inputs belong to the same document + // Support: IE 11+, Edge 17 - 18+ + // IE/Edge sometimes throw a "Permission denied" error when strict-comparing + // two documents; shallow comparisons work. + // eslint-disable-next-line eqeqeq + compare = ( a.ownerDocument || a ) == ( b.ownerDocument || b ) ? + a.compareDocumentPosition( b ) : + + // Otherwise we know they are disconnected + 1; + + // Disconnected nodes + if ( compare & 1 || + ( !support.sortDetached && b.compareDocumentPosition( a ) === compare ) ) { + + // Choose the first element that is related to our preferred document + // Support: IE 11+, Edge 17 - 18+ + // IE/Edge sometimes throw a "Permission denied" error when strict-comparing + // two documents; shallow comparisons work. + // eslint-disable-next-line eqeqeq + if ( a == document || a.ownerDocument == preferredDoc && + contains( preferredDoc, a ) ) { + return -1; + } + + // Support: IE 11+, Edge 17 - 18+ + // IE/Edge sometimes throw a "Permission denied" error when strict-comparing + // two documents; shallow comparisons work. + // eslint-disable-next-line eqeqeq + if ( b == document || b.ownerDocument == preferredDoc && + contains( preferredDoc, b ) ) { + return 1; + } + + // Maintain original order + return sortInput ? + ( indexOf( sortInput, a ) - indexOf( sortInput, b ) ) : + 0; + } + + return compare & 4 ? -1 : 1; + } : + function( a, b ) { + + // Exit early if the nodes are identical + if ( a === b ) { + hasDuplicate = true; + return 0; + } + + var cur, + i = 0, + aup = a.parentNode, + bup = b.parentNode, + ap = [ a ], + bp = [ b ]; + + // Parentless nodes are either documents or disconnected + if ( !aup || !bup ) { + + // Support: IE 11+, Edge 17 - 18+ + // IE/Edge sometimes throw a "Permission denied" error when strict-comparing + // two documents; shallow comparisons work. + /* eslint-disable eqeqeq */ + return a == document ? -1 : + b == document ? 1 : + /* eslint-enable eqeqeq */ + aup ? -1 : + bup ? 1 : + sortInput ? + ( indexOf( sortInput, a ) - indexOf( sortInput, b ) ) : + 0; + + // If the nodes are siblings, we can do a quick check + } else if ( aup === bup ) { + return siblingCheck( a, b ); + } + + // Otherwise we need full lists of their ancestors for comparison + cur = a; + while ( ( cur = cur.parentNode ) ) { + ap.unshift( cur ); + } + cur = b; + while ( ( cur = cur.parentNode ) ) { + bp.unshift( cur ); + } + + // Walk down the tree looking for a discrepancy + while ( ap[ i ] === bp[ i ] ) { + i++; + } + + return i ? + + // Do a sibling check if the nodes have a common ancestor + siblingCheck( ap[ i ], bp[ i ] ) : + + // Otherwise nodes in our document sort first + // Support: IE 11+, Edge 17 - 18+ + // IE/Edge sometimes throw a "Permission denied" error when strict-comparing + // two documents; shallow comparisons work. + /* eslint-disable eqeqeq */ + ap[ i ] == preferredDoc ? -1 : + bp[ i ] == preferredDoc ? 1 : + /* eslint-enable eqeqeq */ + 0; + }; + + return document; +}; + +Sizzle.matches = function( expr, elements ) { + return Sizzle( expr, null, null, elements ); +}; + +Sizzle.matchesSelector = function( elem, expr ) { + setDocument( elem ); + + if ( support.matchesSelector && documentIsHTML && + !nonnativeSelectorCache[ expr + " " ] && + ( !rbuggyMatches || !rbuggyMatches.test( expr ) ) && + ( !rbuggyQSA || !rbuggyQSA.test( expr ) ) ) { + + try { + var ret = matches.call( elem, expr ); + + // IE 9's matchesSelector returns false on disconnected nodes + if ( ret || support.disconnectedMatch || + + // As well, disconnected nodes are said to be in a document + // fragment in IE 9 + elem.document && elem.document.nodeType !== 11 ) { + return ret; + } + } catch ( e ) { + nonnativeSelectorCache( expr, true ); + } + } + + return Sizzle( expr, document, null, [ elem ] ).length > 0; +}; + +Sizzle.contains = function( context, elem ) { + + // Set document vars if needed + // Support: IE 11+, Edge 17 - 18+ + // IE/Edge sometimes throw a "Permission denied" error when strict-comparing + // two documents; shallow comparisons work. + // eslint-disable-next-line eqeqeq + if ( ( context.ownerDocument || context ) != document ) { + setDocument( context ); + } + return contains( context, elem ); +}; + +Sizzle.attr = function( elem, name ) { + + // Set document vars if needed + // Support: IE 11+, Edge 17 - 18+ + // IE/Edge sometimes throw a "Permission denied" error when strict-comparing + // two documents; shallow comparisons work. + // eslint-disable-next-line eqeqeq + if ( ( elem.ownerDocument || elem ) != document ) { + setDocument( elem ); + } + + var fn = Expr.attrHandle[ name.toLowerCase() ], + + // Don't get fooled by Object.prototype properties (jQuery #13807) + val = fn && hasOwn.call( Expr.attrHandle, name.toLowerCase() ) ? + fn( elem, name, !documentIsHTML ) : + undefined; + + return val !== undefined ? + val : + support.attributes || !documentIsHTML ? + elem.getAttribute( name ) : + ( val = elem.getAttributeNode( name ) ) && val.specified ? + val.value : + null; +}; + +Sizzle.escape = function( sel ) { + return ( sel + "" ).replace( rcssescape, fcssescape ); +}; + +Sizzle.error = function( msg ) { + throw new Error( "Syntax error, unrecognized expression: " + msg ); +}; + +/** + * Document sorting and removing duplicates + * @param {ArrayLike} results + */ +Sizzle.uniqueSort = function( results ) { + var elem, + duplicates = [], + j = 0, + i = 0; + + // Unless we *know* we can detect duplicates, assume their presence + hasDuplicate = !support.detectDuplicates; + sortInput = !support.sortStable && results.slice( 0 ); + results.sort( sortOrder ); + + if ( hasDuplicate ) { + while ( ( elem = results[ i++ ] ) ) { + if ( elem === results[ i ] ) { + j = duplicates.push( i ); + } + } + while ( j-- ) { + results.splice( duplicates[ j ], 1 ); + } + } + + // Clear input after sorting to release objects + // See https://github.com/jquery/sizzle/pull/225 + sortInput = null; + + return results; +}; + +/** + * Utility function for retrieving the text value of an array of DOM nodes + * @param {Array|Element} elem + */ +getText = Sizzle.getText = function( elem ) { + var node, + ret = "", + i = 0, + nodeType = elem.nodeType; + + if ( !nodeType ) { + + // If no nodeType, this is expected to be an array + while ( ( node = elem[ i++ ] ) ) { + + // Do not traverse comment nodes + ret += getText( node ); + } + } else if ( nodeType === 1 || nodeType === 9 || nodeType === 11 ) { + + // Use textContent for elements + // innerText usage removed for consistency of new lines (jQuery #11153) + if ( typeof elem.textContent === "string" ) { + return elem.textContent; + } else { + + // Traverse its children + for ( elem = elem.firstChild; elem; elem = elem.nextSibling ) { + ret += getText( elem ); + } + } + } else if ( nodeType === 3 || nodeType === 4 ) { + return elem.nodeValue; + } + + // Do not include comment or processing instruction nodes + + return ret; +}; + +Expr = Sizzle.selectors = { + + // Can be adjusted by the user + cacheLength: 50, + + createPseudo: markFunction, + + match: matchExpr, + + attrHandle: {}, + + find: {}, + + relative: { + ">": { dir: "parentNode", first: true }, + " ": { dir: "parentNode" }, + "+": { dir: "previousSibling", first: true }, + "~": { dir: "previousSibling" } + }, + + preFilter: { + "ATTR": function( match ) { + match[ 1 ] = match[ 1 ].replace( runescape, funescape ); + + // Move the given value to match[3] whether quoted or unquoted + match[ 3 ] = ( match[ 3 ] || match[ 4 ] || + match[ 5 ] || "" ).replace( runescape, funescape ); + + if ( match[ 2 ] === "~=" ) { + match[ 3 ] = " " + match[ 3 ] + " "; + } + + return match.slice( 0, 4 ); + }, + + "CHILD": function( match ) { + + /* matches from matchExpr["CHILD"] + 1 type (only|nth|...) + 2 what (child|of-type) + 3 argument (even|odd|\d*|\d*n([+-]\d+)?|...) + 4 xn-component of xn+y argument ([+-]?\d*n|) + 5 sign of xn-component + 6 x of xn-component + 7 sign of y-component + 8 y of y-component + */ + match[ 1 ] = match[ 1 ].toLowerCase(); + + if ( match[ 1 ].slice( 0, 3 ) === "nth" ) { + + // nth-* requires argument + if ( !match[ 3 ] ) { + Sizzle.error( match[ 0 ] ); + } + + // numeric x and y parameters for Expr.filter.CHILD + // remember that false/true cast respectively to 0/1 + match[ 4 ] = +( match[ 4 ] ? + match[ 5 ] + ( match[ 6 ] || 1 ) : + 2 * ( match[ 3 ] === "even" || match[ 3 ] === "odd" ) ); + match[ 5 ] = +( ( match[ 7 ] + match[ 8 ] ) || match[ 3 ] === "odd" ); + + // other types prohibit arguments + } else if ( match[ 3 ] ) { + Sizzle.error( match[ 0 ] ); + } + + return match; + }, + + "PSEUDO": function( match ) { + var excess, + unquoted = !match[ 6 ] && match[ 2 ]; + + if ( matchExpr[ "CHILD" ].test( match[ 0 ] ) ) { + return null; + } + + // Accept quoted arguments as-is + if ( match[ 3 ] ) { + match[ 2 ] = match[ 4 ] || match[ 5 ] || ""; + + // Strip excess characters from unquoted arguments + } else if ( unquoted && rpseudo.test( unquoted ) && + + // Get excess from tokenize (recursively) + ( excess = tokenize( unquoted, true ) ) && + + // advance to the next closing parenthesis + ( excess = unquoted.indexOf( ")", unquoted.length - excess ) - unquoted.length ) ) { + + // excess is a negative index + match[ 0 ] = match[ 0 ].slice( 0, excess ); + match[ 2 ] = unquoted.slice( 0, excess ); + } + + // Return only captures needed by the pseudo filter method (type and argument) + return match.slice( 0, 3 ); + } + }, + + filter: { + + "TAG": function( nodeNameSelector ) { + var nodeName = nodeNameSelector.replace( runescape, funescape ).toLowerCase(); + return nodeNameSelector === "*" ? + function() { + return true; + } : + function( elem ) { + return elem.nodeName && elem.nodeName.toLowerCase() === nodeName; + }; + }, + + "CLASS": function( className ) { + var pattern = classCache[ className + " " ]; + + return pattern || + ( pattern = new RegExp( "(^|" + whitespace + + ")" + className + "(" + whitespace + "|$)" ) ) && classCache( + className, function( elem ) { + return pattern.test( + typeof elem.className === "string" && elem.className || + typeof elem.getAttribute !== "undefined" && + elem.getAttribute( "class" ) || + "" + ); + } ); + }, + + "ATTR": function( name, operator, check ) { + return function( elem ) { + var result = Sizzle.attr( elem, name ); + + if ( result == null ) { + return operator === "!="; + } + if ( !operator ) { + return true; + } + + result += ""; + + /* eslint-disable max-len */ + + return operator === "=" ? result === check : + operator === "!=" ? result !== check : + operator === "^=" ? check && result.indexOf( check ) === 0 : + operator === "*=" ? check && result.indexOf( check ) > -1 : + operator === "$=" ? check && result.slice( -check.length ) === check : + operator === "~=" ? ( " " + result.replace( rwhitespace, " " ) + " " ).indexOf( check ) > -1 : + operator === "|=" ? result === check || result.slice( 0, check.length + 1 ) === check + "-" : + false; + /* eslint-enable max-len */ + + }; + }, + + "CHILD": function( type, what, _argument, first, last ) { + var simple = type.slice( 0, 3 ) !== "nth", + forward = type.slice( -4 ) !== "last", + ofType = what === "of-type"; + + return first === 1 && last === 0 ? + + // Shortcut for :nth-*(n) + function( elem ) { + return !!elem.parentNode; + } : + + function( elem, _context, xml ) { + var cache, uniqueCache, outerCache, node, nodeIndex, start, + dir = simple !== forward ? "nextSibling" : "previousSibling", + parent = elem.parentNode, + name = ofType && elem.nodeName.toLowerCase(), + useCache = !xml && !ofType, + diff = false; + + if ( parent ) { + + // :(first|last|only)-(child|of-type) + if ( simple ) { + while ( dir ) { + node = elem; + while ( ( node = node[ dir ] ) ) { + if ( ofType ? + node.nodeName.toLowerCase() === name : + node.nodeType === 1 ) { + + return false; + } + } + + // Reverse direction for :only-* (if we haven't yet done so) + start = dir = type === "only" && !start && "nextSibling"; + } + return true; + } + + start = [ forward ? parent.firstChild : parent.lastChild ]; + + // non-xml :nth-child(...) stores cache data on `parent` + if ( forward && useCache ) { + + // Seek `elem` from a previously-cached index + + // ...in a gzip-friendly way + node = parent; + outerCache = node[ expando ] || ( node[ expando ] = {} ); + + // Support: IE <9 only + // Defend against cloned attroperties (jQuery gh-1709) + uniqueCache = outerCache[ node.uniqueID ] || + ( outerCache[ node.uniqueID ] = {} ); + + cache = uniqueCache[ type ] || []; + nodeIndex = cache[ 0 ] === dirruns && cache[ 1 ]; + diff = nodeIndex && cache[ 2 ]; + node = nodeIndex && parent.childNodes[ nodeIndex ]; + + while ( ( node = ++nodeIndex && node && node[ dir ] || + + // Fallback to seeking `elem` from the start + ( diff = nodeIndex = 0 ) || start.pop() ) ) { + + // When found, cache indexes on `parent` and break + if ( node.nodeType === 1 && ++diff && node === elem ) { + uniqueCache[ type ] = [ dirruns, nodeIndex, diff ]; + break; + } + } + + } else { + + // Use previously-cached element index if available + if ( useCache ) { + + // ...in a gzip-friendly way + node = elem; + outerCache = node[ expando ] || ( node[ expando ] = {} ); + + // Support: IE <9 only + // Defend against cloned attroperties (jQuery gh-1709) + uniqueCache = outerCache[ node.uniqueID ] || + ( outerCache[ node.uniqueID ] = {} ); + + cache = uniqueCache[ type ] || []; + nodeIndex = cache[ 0 ] === dirruns && cache[ 1 ]; + diff = nodeIndex; + } + + // xml :nth-child(...) + // or :nth-last-child(...) or :nth(-last)?-of-type(...) + if ( diff === false ) { + + // Use the same loop as above to seek `elem` from the start + while ( ( node = ++nodeIndex && node && node[ dir ] || + ( diff = nodeIndex = 0 ) || start.pop() ) ) { + + if ( ( ofType ? + node.nodeName.toLowerCase() === name : + node.nodeType === 1 ) && + ++diff ) { + + // Cache the index of each encountered element + if ( useCache ) { + outerCache = node[ expando ] || + ( node[ expando ] = {} ); + + // Support: IE <9 only + // Defend against cloned attroperties (jQuery gh-1709) + uniqueCache = outerCache[ node.uniqueID ] || + ( outerCache[ node.uniqueID ] = {} ); + + uniqueCache[ type ] = [ dirruns, diff ]; + } + + if ( node === elem ) { + break; + } + } + } + } + } + + // Incorporate the offset, then check against cycle size + diff -= last; + return diff === first || ( diff % first === 0 && diff / first >= 0 ); + } + }; + }, + + "PSEUDO": function( pseudo, argument ) { + + // pseudo-class names are case-insensitive + // http://www.w3.org/TR/selectors/#pseudo-classes + // Prioritize by case sensitivity in case custom pseudos are added with uppercase letters + // Remember that setFilters inherits from pseudos + var args, + fn = Expr.pseudos[ pseudo ] || Expr.setFilters[ pseudo.toLowerCase() ] || + Sizzle.error( "unsupported pseudo: " + pseudo ); + + // The user may use createPseudo to indicate that + // arguments are needed to create the filter function + // just as Sizzle does + if ( fn[ expando ] ) { + return fn( argument ); + } + + // But maintain support for old signatures + if ( fn.length > 1 ) { + args = [ pseudo, pseudo, "", argument ]; + return Expr.setFilters.hasOwnProperty( pseudo.toLowerCase() ) ? + markFunction( function( seed, matches ) { + var idx, + matched = fn( seed, argument ), + i = matched.length; + while ( i-- ) { + idx = indexOf( seed, matched[ i ] ); + seed[ idx ] = !( matches[ idx ] = matched[ i ] ); + } + } ) : + function( elem ) { + return fn( elem, 0, args ); + }; + } + + return fn; + } + }, + + pseudos: { + + // Potentially complex pseudos + "not": markFunction( function( selector ) { + + // Trim the selector passed to compile + // to avoid treating leading and trailing + // spaces as combinators + var input = [], + results = [], + matcher = compile( selector.replace( rtrim, "$1" ) ); + + return matcher[ expando ] ? + markFunction( function( seed, matches, _context, xml ) { + var elem, + unmatched = matcher( seed, null, xml, [] ), + i = seed.length; + + // Match elements unmatched by `matcher` + while ( i-- ) { + if ( ( elem = unmatched[ i ] ) ) { + seed[ i ] = !( matches[ i ] = elem ); + } + } + } ) : + function( elem, _context, xml ) { + input[ 0 ] = elem; + matcher( input, null, xml, results ); + + // Don't keep the element (issue #299) + input[ 0 ] = null; + return !results.pop(); + }; + } ), + + "has": markFunction( function( selector ) { + return function( elem ) { + return Sizzle( selector, elem ).length > 0; + }; + } ), + + "contains": markFunction( function( text ) { + text = text.replace( runescape, funescape ); + return function( elem ) { + return ( elem.textContent || getText( elem ) ).indexOf( text ) > -1; + }; + } ), + + // "Whether an element is represented by a :lang() selector + // is based solely on the element's language value + // being equal to the identifier C, + // or beginning with the identifier C immediately followed by "-". + // The matching of C against the element's language value is performed case-insensitively. + // The identifier C does not have to be a valid language name." + // http://www.w3.org/TR/selectors/#lang-pseudo + "lang": markFunction( function( lang ) { + + // lang value must be a valid identifier + if ( !ridentifier.test( lang || "" ) ) { + Sizzle.error( "unsupported lang: " + lang ); + } + lang = lang.replace( runescape, funescape ).toLowerCase(); + return function( elem ) { + var elemLang; + do { + if ( ( elemLang = documentIsHTML ? + elem.lang : + elem.getAttribute( "xml:lang" ) || elem.getAttribute( "lang" ) ) ) { + + elemLang = elemLang.toLowerCase(); + return elemLang === lang || elemLang.indexOf( lang + "-" ) === 0; + } + } while ( ( elem = elem.parentNode ) && elem.nodeType === 1 ); + return false; + }; + } ), + + // Miscellaneous + "target": function( elem ) { + var hash = window.location && window.location.hash; + return hash && hash.slice( 1 ) === elem.id; + }, + + "root": function( elem ) { + return elem === docElem; + }, + + "focus": function( elem ) { + return elem === document.activeElement && + ( !document.hasFocus || document.hasFocus() ) && + !!( elem.type || elem.href || ~elem.tabIndex ); + }, + + // Boolean properties + "enabled": createDisabledPseudo( false ), + "disabled": createDisabledPseudo( true ), + + "checked": function( elem ) { + + // In CSS3, :checked should return both checked and selected elements + // http://www.w3.org/TR/2011/REC-css3-selectors-20110929/#checked + var nodeName = elem.nodeName.toLowerCase(); + return ( nodeName === "input" && !!elem.checked ) || + ( nodeName === "option" && !!elem.selected ); + }, + + "selected": function( elem ) { + + // Accessing this property makes selected-by-default + // options in Safari work properly + if ( elem.parentNode ) { + // eslint-disable-next-line no-unused-expressions + elem.parentNode.selectedIndex; + } + + return elem.selected === true; + }, + + // Contents + "empty": function( elem ) { + + // http://www.w3.org/TR/selectors/#empty-pseudo + // :empty is negated by element (1) or content nodes (text: 3; cdata: 4; entity ref: 5), + // but not by others (comment: 8; processing instruction: 7; etc.) + // nodeType < 6 works because attributes (2) do not appear as children + for ( elem = elem.firstChild; elem; elem = elem.nextSibling ) { + if ( elem.nodeType < 6 ) { + return false; + } + } + return true; + }, + + "parent": function( elem ) { + return !Expr.pseudos[ "empty" ]( elem ); + }, + + // Element/input types + "header": function( elem ) { + return rheader.test( elem.nodeName ); + }, + + "input": function( elem ) { + return rinputs.test( elem.nodeName ); + }, + + "button": function( elem ) { + var name = elem.nodeName.toLowerCase(); + return name === "input" && elem.type === "button" || name === "button"; + }, + + "text": function( elem ) { + var attr; + return elem.nodeName.toLowerCase() === "input" && + elem.type === "text" && + + // Support: IE<8 + // New HTML5 attribute values (e.g., "search") appear with elem.type === "text" + ( ( attr = elem.getAttribute( "type" ) ) == null || + attr.toLowerCase() === "text" ); + }, + + // Position-in-collection + "first": createPositionalPseudo( function() { + return [ 0 ]; + } ), + + "last": createPositionalPseudo( function( _matchIndexes, length ) { + return [ length - 1 ]; + } ), + + "eq": createPositionalPseudo( function( _matchIndexes, length, argument ) { + return [ argument < 0 ? argument + length : argument ]; + } ), + + "even": createPositionalPseudo( function( matchIndexes, length ) { + var i = 0; + for ( ; i < length; i += 2 ) { + matchIndexes.push( i ); + } + return matchIndexes; + } ), + + "odd": createPositionalPseudo( function( matchIndexes, length ) { + var i = 1; + for ( ; i < length; i += 2 ) { + matchIndexes.push( i ); + } + return matchIndexes; + } ), + + "lt": createPositionalPseudo( function( matchIndexes, length, argument ) { + var i = argument < 0 ? + argument + length : + argument > length ? + length : + argument; + for ( ; --i >= 0; ) { + matchIndexes.push( i ); + } + return matchIndexes; + } ), + + "gt": createPositionalPseudo( function( matchIndexes, length, argument ) { + var i = argument < 0 ? argument + length : argument; + for ( ; ++i < length; ) { + matchIndexes.push( i ); + } + return matchIndexes; + } ) + } +}; + +Expr.pseudos[ "nth" ] = Expr.pseudos[ "eq" ]; + +// Add button/input type pseudos +for ( i in { radio: true, checkbox: true, file: true, password: true, image: true } ) { + Expr.pseudos[ i ] = createInputPseudo( i ); +} +for ( i in { submit: true, reset: true } ) { + Expr.pseudos[ i ] = createButtonPseudo( i ); +} + +// Easy API for creating new setFilters +function setFilters() {} +setFilters.prototype = Expr.filters = Expr.pseudos; +Expr.setFilters = new setFilters(); + +tokenize = Sizzle.tokenize = function( selector, parseOnly ) { + var matched, match, tokens, type, + soFar, groups, preFilters, + cached = tokenCache[ selector + " " ]; + + if ( cached ) { + return parseOnly ? 0 : cached.slice( 0 ); + } + + soFar = selector; + groups = []; + preFilters = Expr.preFilter; + + while ( soFar ) { + + // Comma and first run + if ( !matched || ( match = rcomma.exec( soFar ) ) ) { + if ( match ) { + + // Don't consume trailing commas as valid + soFar = soFar.slice( match[ 0 ].length ) || soFar; + } + groups.push( ( tokens = [] ) ); + } + + matched = false; + + // Combinators + if ( ( match = rcombinators.exec( soFar ) ) ) { + matched = match.shift(); + tokens.push( { + value: matched, + + // Cast descendant combinators to space + type: match[ 0 ].replace( rtrim, " " ) + } ); + soFar = soFar.slice( matched.length ); + } + + // Filters + for ( type in Expr.filter ) { + if ( ( match = matchExpr[ type ].exec( soFar ) ) && ( !preFilters[ type ] || + ( match = preFilters[ type ]( match ) ) ) ) { + matched = match.shift(); + tokens.push( { + value: matched, + type: type, + matches: match + } ); + soFar = soFar.slice( matched.length ); + } + } + + if ( !matched ) { + break; + } + } + + // Return the length of the invalid excess + // if we're just parsing + // Otherwise, throw an error or return tokens + return parseOnly ? + soFar.length : + soFar ? + Sizzle.error( selector ) : + + // Cache the tokens + tokenCache( selector, groups ).slice( 0 ); +}; + +function toSelector( tokens ) { + var i = 0, + len = tokens.length, + selector = ""; + for ( ; i < len; i++ ) { + selector += tokens[ i ].value; + } + return selector; +} + +function addCombinator( matcher, combinator, base ) { + var dir = combinator.dir, + skip = combinator.next, + key = skip || dir, + checkNonElements = base && key === "parentNode", + doneName = done++; + + return combinator.first ? + + // Check against closest ancestor/preceding element + function( elem, context, xml ) { + while ( ( elem = elem[ dir ] ) ) { + if ( elem.nodeType === 1 || checkNonElements ) { + return matcher( elem, context, xml ); + } + } + return false; + } : + + // Check against all ancestor/preceding elements + function( elem, context, xml ) { + var oldCache, uniqueCache, outerCache, + newCache = [ dirruns, doneName ]; + + // We can't set arbitrary data on XML nodes, so they don't benefit from combinator caching + if ( xml ) { + while ( ( elem = elem[ dir ] ) ) { + if ( elem.nodeType === 1 || checkNonElements ) { + if ( matcher( elem, context, xml ) ) { + return true; + } + } + } + } else { + while ( ( elem = elem[ dir ] ) ) { + if ( elem.nodeType === 1 || checkNonElements ) { + outerCache = elem[ expando ] || ( elem[ expando ] = {} ); + + // Support: IE <9 only + // Defend against cloned attroperties (jQuery gh-1709) + uniqueCache = outerCache[ elem.uniqueID ] || + ( outerCache[ elem.uniqueID ] = {} ); + + if ( skip && skip === elem.nodeName.toLowerCase() ) { + elem = elem[ dir ] || elem; + } else if ( ( oldCache = uniqueCache[ key ] ) && + oldCache[ 0 ] === dirruns && oldCache[ 1 ] === doneName ) { + + // Assign to newCache so results back-propagate to previous elements + return ( newCache[ 2 ] = oldCache[ 2 ] ); + } else { + + // Reuse newcache so results back-propagate to previous elements + uniqueCache[ key ] = newCache; + + // A match means we're done; a fail means we have to keep checking + if ( ( newCache[ 2 ] = matcher( elem, context, xml ) ) ) { + return true; + } + } + } + } + } + return false; + }; +} + +function elementMatcher( matchers ) { + return matchers.length > 1 ? + function( elem, context, xml ) { + var i = matchers.length; + while ( i-- ) { + if ( !matchers[ i ]( elem, context, xml ) ) { + return false; + } + } + return true; + } : + matchers[ 0 ]; +} + +function multipleContexts( selector, contexts, results ) { + var i = 0, + len = contexts.length; + for ( ; i < len; i++ ) { + Sizzle( selector, contexts[ i ], results ); + } + return results; +} + +function condense( unmatched, map, filter, context, xml ) { + var elem, + newUnmatched = [], + i = 0, + len = unmatched.length, + mapped = map != null; + + for ( ; i < len; i++ ) { + if ( ( elem = unmatched[ i ] ) ) { + if ( !filter || filter( elem, context, xml ) ) { + newUnmatched.push( elem ); + if ( mapped ) { + map.push( i ); + } + } + } + } + + return newUnmatched; +} + +function setMatcher( preFilter, selector, matcher, postFilter, postFinder, postSelector ) { + if ( postFilter && !postFilter[ expando ] ) { + postFilter = setMatcher( postFilter ); + } + if ( postFinder && !postFinder[ expando ] ) { + postFinder = setMatcher( postFinder, postSelector ); + } + return markFunction( function( seed, results, context, xml ) { + var temp, i, elem, + preMap = [], + postMap = [], + preexisting = results.length, + + // Get initial elements from seed or context + elems = seed || multipleContexts( + selector || "*", + context.nodeType ? [ context ] : context, + [] + ), + + // Prefilter to get matcher input, preserving a map for seed-results synchronization + matcherIn = preFilter && ( seed || !selector ) ? + condense( elems, preMap, preFilter, context, xml ) : + elems, + + matcherOut = matcher ? + + // If we have a postFinder, or filtered seed, or non-seed postFilter or preexisting results, + postFinder || ( seed ? preFilter : preexisting || postFilter ) ? + + // ...intermediate processing is necessary + [] : + + // ...otherwise use results directly + results : + matcherIn; + + // Find primary matches + if ( matcher ) { + matcher( matcherIn, matcherOut, context, xml ); + } + + // Apply postFilter + if ( postFilter ) { + temp = condense( matcherOut, postMap ); + postFilter( temp, [], context, xml ); + + // Un-match failing elements by moving them back to matcherIn + i = temp.length; + while ( i-- ) { + if ( ( elem = temp[ i ] ) ) { + matcherOut[ postMap[ i ] ] = !( matcherIn[ postMap[ i ] ] = elem ); + } + } + } + + if ( seed ) { + if ( postFinder || preFilter ) { + if ( postFinder ) { + + // Get the final matcherOut by condensing this intermediate into postFinder contexts + temp = []; + i = matcherOut.length; + while ( i-- ) { + if ( ( elem = matcherOut[ i ] ) ) { + + // Restore matcherIn since elem is not yet a final match + temp.push( ( matcherIn[ i ] = elem ) ); + } + } + postFinder( null, ( matcherOut = [] ), temp, xml ); + } + + // Move matched elements from seed to results to keep them synchronized + i = matcherOut.length; + while ( i-- ) { + if ( ( elem = matcherOut[ i ] ) && + ( temp = postFinder ? indexOf( seed, elem ) : preMap[ i ] ) > -1 ) { + + seed[ temp ] = !( results[ temp ] = elem ); + } + } + } + + // Add elements to results, through postFinder if defined + } else { + matcherOut = condense( + matcherOut === results ? + matcherOut.splice( preexisting, matcherOut.length ) : + matcherOut + ); + if ( postFinder ) { + postFinder( null, results, matcherOut, xml ); + } else { + push.apply( results, matcherOut ); + } + } + } ); +} + +function matcherFromTokens( tokens ) { + var checkContext, matcher, j, + len = tokens.length, + leadingRelative = Expr.relative[ tokens[ 0 ].type ], + implicitRelative = leadingRelative || Expr.relative[ " " ], + i = leadingRelative ? 1 : 0, + + // The foundational matcher ensures that elements are reachable from top-level context(s) + matchContext = addCombinator( function( elem ) { + return elem === checkContext; + }, implicitRelative, true ), + matchAnyContext = addCombinator( function( elem ) { + return indexOf( checkContext, elem ) > -1; + }, implicitRelative, true ), + matchers = [ function( elem, context, xml ) { + var ret = ( !leadingRelative && ( xml || context !== outermostContext ) ) || ( + ( checkContext = context ).nodeType ? + matchContext( elem, context, xml ) : + matchAnyContext( elem, context, xml ) ); + + // Avoid hanging onto element (issue #299) + checkContext = null; + return ret; + } ]; + + for ( ; i < len; i++ ) { + if ( ( matcher = Expr.relative[ tokens[ i ].type ] ) ) { + matchers = [ addCombinator( elementMatcher( matchers ), matcher ) ]; + } else { + matcher = Expr.filter[ tokens[ i ].type ].apply( null, tokens[ i ].matches ); + + // Return special upon seeing a positional matcher + if ( matcher[ expando ] ) { + + // Find the next relative operator (if any) for proper handling + j = ++i; + for ( ; j < len; j++ ) { + if ( Expr.relative[ tokens[ j ].type ] ) { + break; + } + } + return setMatcher( + i > 1 && elementMatcher( matchers ), + i > 1 && toSelector( + + // If the preceding token was a descendant combinator, insert an implicit any-element `*` + tokens + .slice( 0, i - 1 ) + .concat( { value: tokens[ i - 2 ].type === " " ? "*" : "" } ) + ).replace( rtrim, "$1" ), + matcher, + i < j && matcherFromTokens( tokens.slice( i, j ) ), + j < len && matcherFromTokens( ( tokens = tokens.slice( j ) ) ), + j < len && toSelector( tokens ) + ); + } + matchers.push( matcher ); + } + } + + return elementMatcher( matchers ); +} + +function matcherFromGroupMatchers( elementMatchers, setMatchers ) { + var bySet = setMatchers.length > 0, + byElement = elementMatchers.length > 0, + superMatcher = function( seed, context, xml, results, outermost ) { + var elem, j, matcher, + matchedCount = 0, + i = "0", + unmatched = seed && [], + setMatched = [], + contextBackup = outermostContext, + + // We must always have either seed elements or outermost context + elems = seed || byElement && Expr.find[ "TAG" ]( "*", outermost ), + + // Use integer dirruns iff this is the outermost matcher + dirrunsUnique = ( dirruns += contextBackup == null ? 1 : Math.random() || 0.1 ), + len = elems.length; + + if ( outermost ) { + + // Support: IE 11+, Edge 17 - 18+ + // IE/Edge sometimes throw a "Permission denied" error when strict-comparing + // two documents; shallow comparisons work. + // eslint-disable-next-line eqeqeq + outermostContext = context == document || context || outermost; + } + + // Add elements passing elementMatchers directly to results + // Support: IE<9, Safari + // Tolerate NodeList properties (IE: "length"; Safari: ) matching elements by id + for ( ; i !== len && ( elem = elems[ i ] ) != null; i++ ) { + if ( byElement && elem ) { + j = 0; + + // Support: IE 11+, Edge 17 - 18+ + // IE/Edge sometimes throw a "Permission denied" error when strict-comparing + // two documents; shallow comparisons work. + // eslint-disable-next-line eqeqeq + if ( !context && elem.ownerDocument != document ) { + setDocument( elem ); + xml = !documentIsHTML; + } + while ( ( matcher = elementMatchers[ j++ ] ) ) { + if ( matcher( elem, context || document, xml ) ) { + results.push( elem ); + break; + } + } + if ( outermost ) { + dirruns = dirrunsUnique; + } + } + + // Track unmatched elements for set filters + if ( bySet ) { + + // They will have gone through all possible matchers + if ( ( elem = !matcher && elem ) ) { + matchedCount--; + } + + // Lengthen the array for every element, matched or not + if ( seed ) { + unmatched.push( elem ); + } + } + } + + // `i` is now the count of elements visited above, and adding it to `matchedCount` + // makes the latter nonnegative. + matchedCount += i; + + // Apply set filters to unmatched elements + // NOTE: This can be skipped if there are no unmatched elements (i.e., `matchedCount` + // equals `i`), unless we didn't visit _any_ elements in the above loop because we have + // no element matchers and no seed. + // Incrementing an initially-string "0" `i` allows `i` to remain a string only in that + // case, which will result in a "00" `matchedCount` that differs from `i` but is also + // numerically zero. + if ( bySet && i !== matchedCount ) { + j = 0; + while ( ( matcher = setMatchers[ j++ ] ) ) { + matcher( unmatched, setMatched, context, xml ); + } + + if ( seed ) { + + // Reintegrate element matches to eliminate the need for sorting + if ( matchedCount > 0 ) { + while ( i-- ) { + if ( !( unmatched[ i ] || setMatched[ i ] ) ) { + setMatched[ i ] = pop.call( results ); + } + } + } + + // Discard index placeholder values to get only actual matches + setMatched = condense( setMatched ); + } + + // Add matches to results + push.apply( results, setMatched ); + + // Seedless set matches succeeding multiple successful matchers stipulate sorting + if ( outermost && !seed && setMatched.length > 0 && + ( matchedCount + setMatchers.length ) > 1 ) { + + Sizzle.uniqueSort( results ); + } + } + + // Override manipulation of globals by nested matchers + if ( outermost ) { + dirruns = dirrunsUnique; + outermostContext = contextBackup; + } + + return unmatched; + }; + + return bySet ? + markFunction( superMatcher ) : + superMatcher; +} + +compile = Sizzle.compile = function( selector, match /* Internal Use Only */ ) { + var i, + setMatchers = [], + elementMatchers = [], + cached = compilerCache[ selector + " " ]; + + if ( !cached ) { + + // Generate a function of recursive functions that can be used to check each element + if ( !match ) { + match = tokenize( selector ); + } + i = match.length; + while ( i-- ) { + cached = matcherFromTokens( match[ i ] ); + if ( cached[ expando ] ) { + setMatchers.push( cached ); + } else { + elementMatchers.push( cached ); + } + } + + // Cache the compiled function + cached = compilerCache( + selector, + matcherFromGroupMatchers( elementMatchers, setMatchers ) + ); + + // Save selector and tokenization + cached.selector = selector; + } + return cached; +}; + +/** + * A low-level selection function that works with Sizzle's compiled + * selector functions + * @param {String|Function} selector A selector or a pre-compiled + * selector function built with Sizzle.compile + * @param {Element} context + * @param {Array} [results] + * @param {Array} [seed] A set of elements to match against + */ +select = Sizzle.select = function( selector, context, results, seed ) { + var i, tokens, token, type, find, + compiled = typeof selector === "function" && selector, + match = !seed && tokenize( ( selector = compiled.selector || selector ) ); + + results = results || []; + + // Try to minimize operations if there is only one selector in the list and no seed + // (the latter of which guarantees us context) + if ( match.length === 1 ) { + + // Reduce context if the leading compound selector is an ID + tokens = match[ 0 ] = match[ 0 ].slice( 0 ); + if ( tokens.length > 2 && ( token = tokens[ 0 ] ).type === "ID" && + context.nodeType === 9 && documentIsHTML && Expr.relative[ tokens[ 1 ].type ] ) { + + context = ( Expr.find[ "ID" ]( token.matches[ 0 ] + .replace( runescape, funescape ), context ) || [] )[ 0 ]; + if ( !context ) { + return results; + + // Precompiled matchers will still verify ancestry, so step up a level + } else if ( compiled ) { + context = context.parentNode; + } + + selector = selector.slice( tokens.shift().value.length ); + } + + // Fetch a seed set for right-to-left matching + i = matchExpr[ "needsContext" ].test( selector ) ? 0 : tokens.length; + while ( i-- ) { + token = tokens[ i ]; + + // Abort if we hit a combinator + if ( Expr.relative[ ( type = token.type ) ] ) { + break; + } + if ( ( find = Expr.find[ type ] ) ) { + + // Search, expanding context for leading sibling combinators + if ( ( seed = find( + token.matches[ 0 ].replace( runescape, funescape ), + rsibling.test( tokens[ 0 ].type ) && testContext( context.parentNode ) || + context + ) ) ) { + + // If seed is empty or no tokens remain, we can return early + tokens.splice( i, 1 ); + selector = seed.length && toSelector( tokens ); + if ( !selector ) { + push.apply( results, seed ); + return results; + } + + break; + } + } + } + } + + // Compile and execute a filtering function if one is not provided + // Provide `match` to avoid retokenization if we modified the selector above + ( compiled || compile( selector, match ) )( + seed, + context, + !documentIsHTML, + results, + !context || rsibling.test( selector ) && testContext( context.parentNode ) || context + ); + return results; +}; + +// One-time assignments + +// Sort stability +support.sortStable = expando.split( "" ).sort( sortOrder ).join( "" ) === expando; + +// Support: Chrome 14-35+ +// Always assume duplicates if they aren't passed to the comparison function +support.detectDuplicates = !!hasDuplicate; + +// Initialize against the default document +setDocument(); + +// Support: Webkit<537.32 - Safari 6.0.3/Chrome 25 (fixed in Chrome 27) +// Detached nodes confoundingly follow *each other* +support.sortDetached = assert( function( el ) { + + // Should return 1, but returns 4 (following) + return el.compareDocumentPosition( document.createElement( "fieldset" ) ) & 1; +} ); + +// Support: IE<8 +// Prevent attribute/property "interpolation" +// https://msdn.microsoft.com/en-us/library/ms536429%28VS.85%29.aspx +if ( !assert( function( el ) { + el.innerHTML = ""; + return el.firstChild.getAttribute( "href" ) === "#"; +} ) ) { + addHandle( "type|href|height|width", function( elem, name, isXML ) { + if ( !isXML ) { + return elem.getAttribute( name, name.toLowerCase() === "type" ? 1 : 2 ); + } + } ); +} + +// Support: IE<9 +// Use defaultValue in place of getAttribute("value") +if ( !support.attributes || !assert( function( el ) { + el.innerHTML = ""; + el.firstChild.setAttribute( "value", "" ); + return el.firstChild.getAttribute( "value" ) === ""; +} ) ) { + addHandle( "value", function( elem, _name, isXML ) { + if ( !isXML && elem.nodeName.toLowerCase() === "input" ) { + return elem.defaultValue; + } + } ); +} + +// Support: IE<9 +// Use getAttributeNode to fetch booleans when getAttribute lies +if ( !assert( function( el ) { + return el.getAttribute( "disabled" ) == null; +} ) ) { + addHandle( booleans, function( elem, name, isXML ) { + var val; + if ( !isXML ) { + return elem[ name ] === true ? name.toLowerCase() : + ( val = elem.getAttributeNode( name ) ) && val.specified ? + val.value : + null; + } + } ); +} + +return Sizzle; + +} )( window ); + + + +jQuery.find = Sizzle; +jQuery.expr = Sizzle.selectors; + +// Deprecated +jQuery.expr[ ":" ] = jQuery.expr.pseudos; +jQuery.uniqueSort = jQuery.unique = Sizzle.uniqueSort; +jQuery.text = Sizzle.getText; +jQuery.isXMLDoc = Sizzle.isXML; +jQuery.contains = Sizzle.contains; +jQuery.escapeSelector = Sizzle.escape; + + + + +var dir = function( elem, dir, until ) { + var matched = [], + truncate = until !== undefined; + + while ( ( elem = elem[ dir ] ) && elem.nodeType !== 9 ) { + if ( elem.nodeType === 1 ) { + if ( truncate && jQuery( elem ).is( until ) ) { + break; + } + matched.push( elem ); + } + } + return matched; +}; + + +var siblings = function( n, elem ) { + var matched = []; + + for ( ; n; n = n.nextSibling ) { + if ( n.nodeType === 1 && n !== elem ) { + matched.push( n ); + } + } + + return matched; +}; + + +var rneedsContext = jQuery.expr.match.needsContext; + + + +function nodeName( elem, name ) { + + return elem.nodeName && elem.nodeName.toLowerCase() === name.toLowerCase(); + +}; +var rsingleTag = ( /^<([a-z][^\/\0>:\x20\t\r\n\f]*)[\x20\t\r\n\f]*\/?>(?:<\/\1>|)$/i ); + + + +// Implement the identical functionality for filter and not +function winnow( elements, qualifier, not ) { + if ( isFunction( qualifier ) ) { + return jQuery.grep( elements, function( elem, i ) { + return !!qualifier.call( elem, i, elem ) !== not; + } ); + } + + // Single element + if ( qualifier.nodeType ) { + return jQuery.grep( elements, function( elem ) { + return ( elem === qualifier ) !== not; + } ); + } + + // Arraylike of elements (jQuery, arguments, Array) + if ( typeof qualifier !== "string" ) { + return jQuery.grep( elements, function( elem ) { + return ( indexOf.call( qualifier, elem ) > -1 ) !== not; + } ); + } + + // Filtered directly for both simple and complex selectors + return jQuery.filter( qualifier, elements, not ); +} + +jQuery.filter = function( expr, elems, not ) { + var elem = elems[ 0 ]; + + if ( not ) { + expr = ":not(" + expr + ")"; + } + + if ( elems.length === 1 && elem.nodeType === 1 ) { + return jQuery.find.matchesSelector( elem, expr ) ? [ elem ] : []; + } + + return jQuery.find.matches( expr, jQuery.grep( elems, function( elem ) { + return elem.nodeType === 1; + } ) ); +}; + +jQuery.fn.extend( { + find: function( selector ) { + var i, ret, + len = this.length, + self = this; + + if ( typeof selector !== "string" ) { + return this.pushStack( jQuery( selector ).filter( function() { + for ( i = 0; i < len; i++ ) { + if ( jQuery.contains( self[ i ], this ) ) { + return true; + } + } + } ) ); + } + + ret = this.pushStack( [] ); + + for ( i = 0; i < len; i++ ) { + jQuery.find( selector, self[ i ], ret ); + } + + return len > 1 ? jQuery.uniqueSort( ret ) : ret; + }, + filter: function( selector ) { + return this.pushStack( winnow( this, selector || [], false ) ); + }, + not: function( selector ) { + return this.pushStack( winnow( this, selector || [], true ) ); + }, + is: function( selector ) { + return !!winnow( + this, + + // If this is a positional/relative selector, check membership in the returned set + // so $("p:first").is("p:last") won't return true for a doc with two "p". + typeof selector === "string" && rneedsContext.test( selector ) ? + jQuery( selector ) : + selector || [], + false + ).length; + } +} ); + + +// Initialize a jQuery object + + +// A central reference to the root jQuery(document) +var rootjQuery, + + // A simple way to check for HTML strings + // Prioritize #id over to avoid XSS via location.hash (#9521) + // Strict HTML recognition (#11290: must start with <) + // Shortcut simple #id case for speed + rquickExpr = /^(?:\s*(<[\w\W]+>)[^>]*|#([\w-]+))$/, + + init = jQuery.fn.init = function( selector, context, root ) { + var match, elem; + + // HANDLE: $(""), $(null), $(undefined), $(false) + if ( !selector ) { + return this; + } + + // Method init() accepts an alternate rootjQuery + // so migrate can support jQuery.sub (gh-2101) + root = root || rootjQuery; + + // Handle HTML strings + if ( typeof selector === "string" ) { + if ( selector[ 0 ] === "<" && + selector[ selector.length - 1 ] === ">" && + selector.length >= 3 ) { + + // Assume that strings that start and end with <> are HTML and skip the regex check + match = [ null, selector, null ]; + + } else { + match = rquickExpr.exec( selector ); + } + + // Match html or make sure no context is specified for #id + if ( match && ( match[ 1 ] || !context ) ) { + + // HANDLE: $(html) -> $(array) + if ( match[ 1 ] ) { + context = context instanceof jQuery ? context[ 0 ] : context; + + // Option to run scripts is true for back-compat + // Intentionally let the error be thrown if parseHTML is not present + jQuery.merge( this, jQuery.parseHTML( + match[ 1 ], + context && context.nodeType ? context.ownerDocument || context : document, + true + ) ); + + // HANDLE: $(html, props) + if ( rsingleTag.test( match[ 1 ] ) && jQuery.isPlainObject( context ) ) { + for ( match in context ) { + + // Properties of context are called as methods if possible + if ( isFunction( this[ match ] ) ) { + this[ match ]( context[ match ] ); + + // ...and otherwise set as attributes + } else { + this.attr( match, context[ match ] ); + } + } + } + + return this; + + // HANDLE: $(#id) + } else { + elem = document.getElementById( match[ 2 ] ); + + if ( elem ) { + + // Inject the element directly into the jQuery object + this[ 0 ] = elem; + this.length = 1; + } + return this; + } + + // HANDLE: $(expr, $(...)) + } else if ( !context || context.jquery ) { + return ( context || root ).find( selector ); + + // HANDLE: $(expr, context) + // (which is just equivalent to: $(context).find(expr) + } else { + return this.constructor( context ).find( selector ); + } + + // HANDLE: $(DOMElement) + } else if ( selector.nodeType ) { + this[ 0 ] = selector; + this.length = 1; + return this; + + // HANDLE: $(function) + // Shortcut for document ready + } else if ( isFunction( selector ) ) { + return root.ready !== undefined ? + root.ready( selector ) : + + // Execute immediately if ready is not present + selector( jQuery ); + } + + return jQuery.makeArray( selector, this ); + }; + +// Give the init function the jQuery prototype for later instantiation +init.prototype = jQuery.fn; + +// Initialize central reference +rootjQuery = jQuery( document ); + + +var rparentsprev = /^(?:parents|prev(?:Until|All))/, + + // Methods guaranteed to produce a unique set when starting from a unique set + guaranteedUnique = { + children: true, + contents: true, + next: true, + prev: true + }; + +jQuery.fn.extend( { + has: function( target ) { + var targets = jQuery( target, this ), + l = targets.length; + + return this.filter( function() { + var i = 0; + for ( ; i < l; i++ ) { + if ( jQuery.contains( this, targets[ i ] ) ) { + return true; + } + } + } ); + }, + + closest: function( selectors, context ) { + var cur, + i = 0, + l = this.length, + matched = [], + targets = typeof selectors !== "string" && jQuery( selectors ); + + // Positional selectors never match, since there's no _selection_ context + if ( !rneedsContext.test( selectors ) ) { + for ( ; i < l; i++ ) { + for ( cur = this[ i ]; cur && cur !== context; cur = cur.parentNode ) { + + // Always skip document fragments + if ( cur.nodeType < 11 && ( targets ? + targets.index( cur ) > -1 : + + // Don't pass non-elements to Sizzle + cur.nodeType === 1 && + jQuery.find.matchesSelector( cur, selectors ) ) ) { + + matched.push( cur ); + break; + } + } + } + } + + return this.pushStack( matched.length > 1 ? jQuery.uniqueSort( matched ) : matched ); + }, + + // Determine the position of an element within the set + index: function( elem ) { + + // No argument, return index in parent + if ( !elem ) { + return ( this[ 0 ] && this[ 0 ].parentNode ) ? this.first().prevAll().length : -1; + } + + // Index in selector + if ( typeof elem === "string" ) { + return indexOf.call( jQuery( elem ), this[ 0 ] ); + } + + // Locate the position of the desired element + return indexOf.call( this, + + // If it receives a jQuery object, the first element is used + elem.jquery ? elem[ 0 ] : elem + ); + }, + + add: function( selector, context ) { + return this.pushStack( + jQuery.uniqueSort( + jQuery.merge( this.get(), jQuery( selector, context ) ) + ) + ); + }, + + addBack: function( selector ) { + return this.add( selector == null ? + this.prevObject : this.prevObject.filter( selector ) + ); + } +} ); + +function sibling( cur, dir ) { + while ( ( cur = cur[ dir ] ) && cur.nodeType !== 1 ) {} + return cur; +} + +jQuery.each( { + parent: function( elem ) { + var parent = elem.parentNode; + return parent && parent.nodeType !== 11 ? parent : null; + }, + parents: function( elem ) { + return dir( elem, "parentNode" ); + }, + parentsUntil: function( elem, _i, until ) { + return dir( elem, "parentNode", until ); + }, + next: function( elem ) { + return sibling( elem, "nextSibling" ); + }, + prev: function( elem ) { + return sibling( elem, "previousSibling" ); + }, + nextAll: function( elem ) { + return dir( elem, "nextSibling" ); + }, + prevAll: function( elem ) { + return dir( elem, "previousSibling" ); + }, + nextUntil: function( elem, _i, until ) { + return dir( elem, "nextSibling", until ); + }, + prevUntil: function( elem, _i, until ) { + return dir( elem, "previousSibling", until ); + }, + siblings: function( elem ) { + return siblings( ( elem.parentNode || {} ).firstChild, elem ); + }, + children: function( elem ) { + return siblings( elem.firstChild ); + }, + contents: function( elem ) { + if ( elem.contentDocument != null && + + // Support: IE 11+ + // elements with no `data` attribute has an object + // `contentDocument` with a `null` prototype. + getProto( elem.contentDocument ) ) { + + return elem.contentDocument; + } + + // Support: IE 9 - 11 only, iOS 7 only, Android Browser <=4.3 only + // Treat the template element as a regular one in browsers that + // don't support it. + if ( nodeName( elem, "template" ) ) { + elem = elem.content || elem; + } + + return jQuery.merge( [], elem.childNodes ); + } +}, function( name, fn ) { + jQuery.fn[ name ] = function( until, selector ) { + var matched = jQuery.map( this, fn, until ); + + if ( name.slice( -5 ) !== "Until" ) { + selector = until; + } + + if ( selector && typeof selector === "string" ) { + matched = jQuery.filter( selector, matched ); + } + + if ( this.length > 1 ) { + + // Remove duplicates + if ( !guaranteedUnique[ name ] ) { + jQuery.uniqueSort( matched ); + } + + // Reverse order for parents* and prev-derivatives + if ( rparentsprev.test( name ) ) { + matched.reverse(); + } + } + + return this.pushStack( matched ); + }; +} ); +var rnothtmlwhite = ( /[^\x20\t\r\n\f]+/g ); + + + +// Convert String-formatted options into Object-formatted ones +function createOptions( options ) { + var object = {}; + jQuery.each( options.match( rnothtmlwhite ) || [], function( _, flag ) { + object[ flag ] = true; + } ); + return object; +} + +/* + * Create a callback list using the following parameters: + * + * options: an optional list of space-separated options that will change how + * the callback list behaves or a more traditional option object + * + * By default a callback list will act like an event callback list and can be + * "fired" multiple times. + * + * Possible options: + * + * once: will ensure the callback list can only be fired once (like a Deferred) + * + * memory: will keep track of previous values and will call any callback added + * after the list has been fired right away with the latest "memorized" + * values (like a Deferred) + * + * unique: will ensure a callback can only be added once (no duplicate in the list) + * + * stopOnFalse: interrupt callings when a callback returns false + * + */ +jQuery.Callbacks = function( options ) { + + // Convert options from String-formatted to Object-formatted if needed + // (we check in cache first) + options = typeof options === "string" ? + createOptions( options ) : + jQuery.extend( {}, options ); + + var // Flag to know if list is currently firing + firing, + + // Last fire value for non-forgettable lists + memory, + + // Flag to know if list was already fired + fired, + + // Flag to prevent firing + locked, + + // Actual callback list + list = [], + + // Queue of execution data for repeatable lists + queue = [], + + // Index of currently firing callback (modified by add/remove as needed) + firingIndex = -1, + + // Fire callbacks + fire = function() { + + // Enforce single-firing + locked = locked || options.once; + + // Execute callbacks for all pending executions, + // respecting firingIndex overrides and runtime changes + fired = firing = true; + for ( ; queue.length; firingIndex = -1 ) { + memory = queue.shift(); + while ( ++firingIndex < list.length ) { + + // Run callback and check for early termination + if ( list[ firingIndex ].apply( memory[ 0 ], memory[ 1 ] ) === false && + options.stopOnFalse ) { + + // Jump to end and forget the data so .add doesn't re-fire + firingIndex = list.length; + memory = false; + } + } + } + + // Forget the data if we're done with it + if ( !options.memory ) { + memory = false; + } + + firing = false; + + // Clean up if we're done firing for good + if ( locked ) { + + // Keep an empty list if we have data for future add calls + if ( memory ) { + list = []; + + // Otherwise, this object is spent + } else { + list = ""; + } + } + }, + + // Actual Callbacks object + self = { + + // Add a callback or a collection of callbacks to the list + add: function() { + if ( list ) { + + // If we have memory from a past run, we should fire after adding + if ( memory && !firing ) { + firingIndex = list.length - 1; + queue.push( memory ); + } + + ( function add( args ) { + jQuery.each( args, function( _, arg ) { + if ( isFunction( arg ) ) { + if ( !options.unique || !self.has( arg ) ) { + list.push( arg ); + } + } else if ( arg && arg.length && toType( arg ) !== "string" ) { + + // Inspect recursively + add( arg ); + } + } ); + } )( arguments ); + + if ( memory && !firing ) { + fire(); + } + } + return this; + }, + + // Remove a callback from the list + remove: function() { + jQuery.each( arguments, function( _, arg ) { + var index; + while ( ( index = jQuery.inArray( arg, list, index ) ) > -1 ) { + list.splice( index, 1 ); + + // Handle firing indexes + if ( index <= firingIndex ) { + firingIndex--; + } + } + } ); + return this; + }, + + // Check if a given callback is in the list. + // If no argument is given, return whether or not list has callbacks attached. + has: function( fn ) { + return fn ? + jQuery.inArray( fn, list ) > -1 : + list.length > 0; + }, + + // Remove all callbacks from the list + empty: function() { + if ( list ) { + list = []; + } + return this; + }, + + // Disable .fire and .add + // Abort any current/pending executions + // Clear all callbacks and values + disable: function() { + locked = queue = []; + list = memory = ""; + return this; + }, + disabled: function() { + return !list; + }, + + // Disable .fire + // Also disable .add unless we have memory (since it would have no effect) + // Abort any pending executions + lock: function() { + locked = queue = []; + if ( !memory && !firing ) { + list = memory = ""; + } + return this; + }, + locked: function() { + return !!locked; + }, + + // Call all callbacks with the given context and arguments + fireWith: function( context, args ) { + if ( !locked ) { + args = args || []; + args = [ context, args.slice ? args.slice() : args ]; + queue.push( args ); + if ( !firing ) { + fire(); + } + } + return this; + }, + + // Call all the callbacks with the given arguments + fire: function() { + self.fireWith( this, arguments ); + return this; + }, + + // To know if the callbacks have already been called at least once + fired: function() { + return !!fired; + } + }; + + return self; +}; + + +function Identity( v ) { + return v; +} +function Thrower( ex ) { + throw ex; +} + +function adoptValue( value, resolve, reject, noValue ) { + var method; + + try { + + // Check for promise aspect first to privilege synchronous behavior + if ( value && isFunction( ( method = value.promise ) ) ) { + method.call( value ).done( resolve ).fail( reject ); + + // Other thenables + } else if ( value && isFunction( ( method = value.then ) ) ) { + method.call( value, resolve, reject ); + + // Other non-thenables + } else { + + // Control `resolve` arguments by letting Array#slice cast boolean `noValue` to integer: + // * false: [ value ].slice( 0 ) => resolve( value ) + // * true: [ value ].slice( 1 ) => resolve() + resolve.apply( undefined, [ value ].slice( noValue ) ); + } + + // For Promises/A+, convert exceptions into rejections + // Since jQuery.when doesn't unwrap thenables, we can skip the extra checks appearing in + // Deferred#then to conditionally suppress rejection. + } catch ( value ) { + + // Support: Android 4.0 only + // Strict mode functions invoked without .call/.apply get global-object context + reject.apply( undefined, [ value ] ); + } +} + +jQuery.extend( { + + Deferred: function( func ) { + var tuples = [ + + // action, add listener, callbacks, + // ... .then handlers, argument index, [final state] + [ "notify", "progress", jQuery.Callbacks( "memory" ), + jQuery.Callbacks( "memory" ), 2 ], + [ "resolve", "done", jQuery.Callbacks( "once memory" ), + jQuery.Callbacks( "once memory" ), 0, "resolved" ], + [ "reject", "fail", jQuery.Callbacks( "once memory" ), + jQuery.Callbacks( "once memory" ), 1, "rejected" ] + ], + state = "pending", + promise = { + state: function() { + return state; + }, + always: function() { + deferred.done( arguments ).fail( arguments ); + return this; + }, + "catch": function( fn ) { + return promise.then( null, fn ); + }, + + // Keep pipe for back-compat + pipe: function( /* fnDone, fnFail, fnProgress */ ) { + var fns = arguments; + + return jQuery.Deferred( function( newDefer ) { + jQuery.each( tuples, function( _i, tuple ) { + + // Map tuples (progress, done, fail) to arguments (done, fail, progress) + var fn = isFunction( fns[ tuple[ 4 ] ] ) && fns[ tuple[ 4 ] ]; + + // deferred.progress(function() { bind to newDefer or newDefer.notify }) + // deferred.done(function() { bind to newDefer or newDefer.resolve }) + // deferred.fail(function() { bind to newDefer or newDefer.reject }) + deferred[ tuple[ 1 ] ]( function() { + var returned = fn && fn.apply( this, arguments ); + if ( returned && isFunction( returned.promise ) ) { + returned.promise() + .progress( newDefer.notify ) + .done( newDefer.resolve ) + .fail( newDefer.reject ); + } else { + newDefer[ tuple[ 0 ] + "With" ]( + this, + fn ? [ returned ] : arguments + ); + } + } ); + } ); + fns = null; + } ).promise(); + }, + then: function( onFulfilled, onRejected, onProgress ) { + var maxDepth = 0; + function resolve( depth, deferred, handler, special ) { + return function() { + var that = this, + args = arguments, + mightThrow = function() { + var returned, then; + + // Support: Promises/A+ section 2.3.3.3.3 + // https://promisesaplus.com/#point-59 + // Ignore double-resolution attempts + if ( depth < maxDepth ) { + return; + } + + returned = handler.apply( that, args ); + + // Support: Promises/A+ section 2.3.1 + // https://promisesaplus.com/#point-48 + if ( returned === deferred.promise() ) { + throw new TypeError( "Thenable self-resolution" ); + } + + // Support: Promises/A+ sections 2.3.3.1, 3.5 + // https://promisesaplus.com/#point-54 + // https://promisesaplus.com/#point-75 + // Retrieve `then` only once + then = returned && + + // Support: Promises/A+ section 2.3.4 + // https://promisesaplus.com/#point-64 + // Only check objects and functions for thenability + ( typeof returned === "object" || + typeof returned === "function" ) && + returned.then; + + // Handle a returned thenable + if ( isFunction( then ) ) { + + // Special processors (notify) just wait for resolution + if ( special ) { + then.call( + returned, + resolve( maxDepth, deferred, Identity, special ), + resolve( maxDepth, deferred, Thrower, special ) + ); + + // Normal processors (resolve) also hook into progress + } else { + + // ...and disregard older resolution values + maxDepth++; + + then.call( + returned, + resolve( maxDepth, deferred, Identity, special ), + resolve( maxDepth, deferred, Thrower, special ), + resolve( maxDepth, deferred, Identity, + deferred.notifyWith ) + ); + } + + // Handle all other returned values + } else { + + // Only substitute handlers pass on context + // and multiple values (non-spec behavior) + if ( handler !== Identity ) { + that = undefined; + args = [ returned ]; + } + + // Process the value(s) + // Default process is resolve + ( special || deferred.resolveWith )( that, args ); + } + }, + + // Only normal processors (resolve) catch and reject exceptions + process = special ? + mightThrow : + function() { + try { + mightThrow(); + } catch ( e ) { + + if ( jQuery.Deferred.exceptionHook ) { + jQuery.Deferred.exceptionHook( e, + process.stackTrace ); + } + + // Support: Promises/A+ section 2.3.3.3.4.1 + // https://promisesaplus.com/#point-61 + // Ignore post-resolution exceptions + if ( depth + 1 >= maxDepth ) { + + // Only substitute handlers pass on context + // and multiple values (non-spec behavior) + if ( handler !== Thrower ) { + that = undefined; + args = [ e ]; + } + + deferred.rejectWith( that, args ); + } + } + }; + + // Support: Promises/A+ section 2.3.3.3.1 + // https://promisesaplus.com/#point-57 + // Re-resolve promises immediately to dodge false rejection from + // subsequent errors + if ( depth ) { + process(); + } else { + + // Call an optional hook to record the stack, in case of exception + // since it's otherwise lost when execution goes async + if ( jQuery.Deferred.getStackHook ) { + process.stackTrace = jQuery.Deferred.getStackHook(); + } + window.setTimeout( process ); + } + }; + } + + return jQuery.Deferred( function( newDefer ) { + + // progress_handlers.add( ... ) + tuples[ 0 ][ 3 ].add( + resolve( + 0, + newDefer, + isFunction( onProgress ) ? + onProgress : + Identity, + newDefer.notifyWith + ) + ); + + // fulfilled_handlers.add( ... ) + tuples[ 1 ][ 3 ].add( + resolve( + 0, + newDefer, + isFunction( onFulfilled ) ? + onFulfilled : + Identity + ) + ); + + // rejected_handlers.add( ... ) + tuples[ 2 ][ 3 ].add( + resolve( + 0, + newDefer, + isFunction( onRejected ) ? + onRejected : + Thrower + ) + ); + } ).promise(); + }, + + // Get a promise for this deferred + // If obj is provided, the promise aspect is added to the object + promise: function( obj ) { + return obj != null ? jQuery.extend( obj, promise ) : promise; + } + }, + deferred = {}; + + // Add list-specific methods + jQuery.each( tuples, function( i, tuple ) { + var list = tuple[ 2 ], + stateString = tuple[ 5 ]; + + // promise.progress = list.add + // promise.done = list.add + // promise.fail = list.add + promise[ tuple[ 1 ] ] = list.add; + + // Handle state + if ( stateString ) { + list.add( + function() { + + // state = "resolved" (i.e., fulfilled) + // state = "rejected" + state = stateString; + }, + + // rejected_callbacks.disable + // fulfilled_callbacks.disable + tuples[ 3 - i ][ 2 ].disable, + + // rejected_handlers.disable + // fulfilled_handlers.disable + tuples[ 3 - i ][ 3 ].disable, + + // progress_callbacks.lock + tuples[ 0 ][ 2 ].lock, + + // progress_handlers.lock + tuples[ 0 ][ 3 ].lock + ); + } + + // progress_handlers.fire + // fulfilled_handlers.fire + // rejected_handlers.fire + list.add( tuple[ 3 ].fire ); + + // deferred.notify = function() { deferred.notifyWith(...) } + // deferred.resolve = function() { deferred.resolveWith(...) } + // deferred.reject = function() { deferred.rejectWith(...) } + deferred[ tuple[ 0 ] ] = function() { + deferred[ tuple[ 0 ] + "With" ]( this === deferred ? undefined : this, arguments ); + return this; + }; + + // deferred.notifyWith = list.fireWith + // deferred.resolveWith = list.fireWith + // deferred.rejectWith = list.fireWith + deferred[ tuple[ 0 ] + "With" ] = list.fireWith; + } ); + + // Make the deferred a promise + promise.promise( deferred ); + + // Call given func if any + if ( func ) { + func.call( deferred, deferred ); + } + + // All done! + return deferred; + }, + + // Deferred helper + when: function( singleValue ) { + var + + // count of uncompleted subordinates + remaining = arguments.length, + + // count of unprocessed arguments + i = remaining, + + // subordinate fulfillment data + resolveContexts = Array( i ), + resolveValues = slice.call( arguments ), + + // the master Deferred + master = jQuery.Deferred(), + + // subordinate callback factory + updateFunc = function( i ) { + return function( value ) { + resolveContexts[ i ] = this; + resolveValues[ i ] = arguments.length > 1 ? slice.call( arguments ) : value; + if ( !( --remaining ) ) { + master.resolveWith( resolveContexts, resolveValues ); + } + }; + }; + + // Single- and empty arguments are adopted like Promise.resolve + if ( remaining <= 1 ) { + adoptValue( singleValue, master.done( updateFunc( i ) ).resolve, master.reject, + !remaining ); + + // Use .then() to unwrap secondary thenables (cf. gh-3000) + if ( master.state() === "pending" || + isFunction( resolveValues[ i ] && resolveValues[ i ].then ) ) { + + return master.then(); + } + } + + // Multiple arguments are aggregated like Promise.all array elements + while ( i-- ) { + adoptValue( resolveValues[ i ], updateFunc( i ), master.reject ); + } + + return master.promise(); + } +} ); + + +// These usually indicate a programmer mistake during development, +// warn about them ASAP rather than swallowing them by default. +var rerrorNames = /^(Eval|Internal|Range|Reference|Syntax|Type|URI)Error$/; + +jQuery.Deferred.exceptionHook = function( error, stack ) { + + // Support: IE 8 - 9 only + // Console exists when dev tools are open, which can happen at any time + if ( window.console && window.console.warn && error && rerrorNames.test( error.name ) ) { + window.console.warn( "jQuery.Deferred exception: " + error.message, error.stack, stack ); + } +}; + + + + +jQuery.readyException = function( error ) { + window.setTimeout( function() { + throw error; + } ); +}; + + + + +// The deferred used on DOM ready +var readyList = jQuery.Deferred(); + +jQuery.fn.ready = function( fn ) { + + readyList + .then( fn ) + + // Wrap jQuery.readyException in a function so that the lookup + // happens at the time of error handling instead of callback + // registration. + .catch( function( error ) { + jQuery.readyException( error ); + } ); + + return this; +}; + +jQuery.extend( { + + // Is the DOM ready to be used? Set to true once it occurs. + isReady: false, + + // A counter to track how many items to wait for before + // the ready event fires. See #6781 + readyWait: 1, + + // Handle when the DOM is ready + ready: function( wait ) { + + // Abort if there are pending holds or we're already ready + if ( wait === true ? --jQuery.readyWait : jQuery.isReady ) { + return; + } + + // Remember that the DOM is ready + jQuery.isReady = true; + + // If a normal DOM Ready event fired, decrement, and wait if need be + if ( wait !== true && --jQuery.readyWait > 0 ) { + return; + } + + // If there are functions bound, to execute + readyList.resolveWith( document, [ jQuery ] ); + } +} ); + +jQuery.ready.then = readyList.then; + +// The ready event handler and self cleanup method +function completed() { + document.removeEventListener( "DOMContentLoaded", completed ); + window.removeEventListener( "load", completed ); + jQuery.ready(); +} + +// Catch cases where $(document).ready() is called +// after the browser event has already occurred. +// Support: IE <=9 - 10 only +// Older IE sometimes signals "interactive" too soon +if ( document.readyState === "complete" || + ( document.readyState !== "loading" && !document.documentElement.doScroll ) ) { + + // Handle it asynchronously to allow scripts the opportunity to delay ready + window.setTimeout( jQuery.ready ); + +} else { + + // Use the handy event callback + document.addEventListener( "DOMContentLoaded", completed ); + + // A fallback to window.onload, that will always work + window.addEventListener( "load", completed ); +} + + + + +// Multifunctional method to get and set values of a collection +// The value/s can optionally be executed if it's a function +var access = function( elems, fn, key, value, chainable, emptyGet, raw ) { + var i = 0, + len = elems.length, + bulk = key == null; + + // Sets many values + if ( toType( key ) === "object" ) { + chainable = true; + for ( i in key ) { + access( elems, fn, i, key[ i ], true, emptyGet, raw ); + } + + // Sets one value + } else if ( value !== undefined ) { + chainable = true; + + if ( !isFunction( value ) ) { + raw = true; + } + + if ( bulk ) { + + // Bulk operations run against the entire set + if ( raw ) { + fn.call( elems, value ); + fn = null; + + // ...except when executing function values + } else { + bulk = fn; + fn = function( elem, _key, value ) { + return bulk.call( jQuery( elem ), value ); + }; + } + } + + if ( fn ) { + for ( ; i < len; i++ ) { + fn( + elems[ i ], key, raw ? + value : + value.call( elems[ i ], i, fn( elems[ i ], key ) ) + ); + } + } + } + + if ( chainable ) { + return elems; + } + + // Gets + if ( bulk ) { + return fn.call( elems ); + } + + return len ? fn( elems[ 0 ], key ) : emptyGet; +}; + + +// Matches dashed string for camelizing +var rmsPrefix = /^-ms-/, + rdashAlpha = /-([a-z])/g; + +// Used by camelCase as callback to replace() +function fcamelCase( _all, letter ) { + return letter.toUpperCase(); +} + +// Convert dashed to camelCase; used by the css and data modules +// Support: IE <=9 - 11, Edge 12 - 15 +// Microsoft forgot to hump their vendor prefix (#9572) +function camelCase( string ) { + return string.replace( rmsPrefix, "ms-" ).replace( rdashAlpha, fcamelCase ); +} +var acceptData = function( owner ) { + + // Accepts only: + // - Node + // - Node.ELEMENT_NODE + // - Node.DOCUMENT_NODE + // - Object + // - Any + return owner.nodeType === 1 || owner.nodeType === 9 || !( +owner.nodeType ); +}; + + + + +function Data() { + this.expando = jQuery.expando + Data.uid++; +} + +Data.uid = 1; + +Data.prototype = { + + cache: function( owner ) { + + // Check if the owner object already has a cache + var value = owner[ this.expando ]; + + // If not, create one + if ( !value ) { + value = {}; + + // We can accept data for non-element nodes in modern browsers, + // but we should not, see #8335. + // Always return an empty object. + if ( acceptData( owner ) ) { + + // If it is a node unlikely to be stringify-ed or looped over + // use plain assignment + if ( owner.nodeType ) { + owner[ this.expando ] = value; + + // Otherwise secure it in a non-enumerable property + // configurable must be true to allow the property to be + // deleted when data is removed + } else { + Object.defineProperty( owner, this.expando, { + value: value, + configurable: true + } ); + } + } + } + + return value; + }, + set: function( owner, data, value ) { + var prop, + cache = this.cache( owner ); + + // Handle: [ owner, key, value ] args + // Always use camelCase key (gh-2257) + if ( typeof data === "string" ) { + cache[ camelCase( data ) ] = value; + + // Handle: [ owner, { properties } ] args + } else { + + // Copy the properties one-by-one to the cache object + for ( prop in data ) { + cache[ camelCase( prop ) ] = data[ prop ]; + } + } + return cache; + }, + get: function( owner, key ) { + return key === undefined ? + this.cache( owner ) : + + // Always use camelCase key (gh-2257) + owner[ this.expando ] && owner[ this.expando ][ camelCase( key ) ]; + }, + access: function( owner, key, value ) { + + // In cases where either: + // + // 1. No key was specified + // 2. A string key was specified, but no value provided + // + // Take the "read" path and allow the get method to determine + // which value to return, respectively either: + // + // 1. The entire cache object + // 2. The data stored at the key + // + if ( key === undefined || + ( ( key && typeof key === "string" ) && value === undefined ) ) { + + return this.get( owner, key ); + } + + // When the key is not a string, or both a key and value + // are specified, set or extend (existing objects) with either: + // + // 1. An object of properties + // 2. A key and value + // + this.set( owner, key, value ); + + // Since the "set" path can have two possible entry points + // return the expected data based on which path was taken[*] + return value !== undefined ? value : key; + }, + remove: function( owner, key ) { + var i, + cache = owner[ this.expando ]; + + if ( cache === undefined ) { + return; + } + + if ( key !== undefined ) { + + // Support array or space separated string of keys + if ( Array.isArray( key ) ) { + + // If key is an array of keys... + // We always set camelCase keys, so remove that. + key = key.map( camelCase ); + } else { + key = camelCase( key ); + + // If a key with the spaces exists, use it. + // Otherwise, create an array by matching non-whitespace + key = key in cache ? + [ key ] : + ( key.match( rnothtmlwhite ) || [] ); + } + + i = key.length; + + while ( i-- ) { + delete cache[ key[ i ] ]; + } + } + + // Remove the expando if there's no more data + if ( key === undefined || jQuery.isEmptyObject( cache ) ) { + + // Support: Chrome <=35 - 45 + // Webkit & Blink performance suffers when deleting properties + // from DOM nodes, so set to undefined instead + // https://bugs.chromium.org/p/chromium/issues/detail?id=378607 (bug restricted) + if ( owner.nodeType ) { + owner[ this.expando ] = undefined; + } else { + delete owner[ this.expando ]; + } + } + }, + hasData: function( owner ) { + var cache = owner[ this.expando ]; + return cache !== undefined && !jQuery.isEmptyObject( cache ); + } +}; +var dataPriv = new Data(); + +var dataUser = new Data(); + + + +// Implementation Summary +// +// 1. Enforce API surface and semantic compatibility with 1.9.x branch +// 2. Improve the module's maintainability by reducing the storage +// paths to a single mechanism. +// 3. Use the same single mechanism to support "private" and "user" data. +// 4. _Never_ expose "private" data to user code (TODO: Drop _data, _removeData) +// 5. Avoid exposing implementation details on user objects (eg. expando properties) +// 6. Provide a clear path for implementation upgrade to WeakMap in 2014 + +var rbrace = /^(?:\{[\w\W]*\}|\[[\w\W]*\])$/, + rmultiDash = /[A-Z]/g; + +function getData( data ) { + if ( data === "true" ) { + return true; + } + + if ( data === "false" ) { + return false; + } + + if ( data === "null" ) { + return null; + } + + // Only convert to a number if it doesn't change the string + if ( data === +data + "" ) { + return +data; + } + + if ( rbrace.test( data ) ) { + return JSON.parse( data ); + } + + return data; +} + +function dataAttr( elem, key, data ) { + var name; + + // If nothing was found internally, try to fetch any + // data from the HTML5 data-* attribute + if ( data === undefined && elem.nodeType === 1 ) { + name = "data-" + key.replace( rmultiDash, "-$&" ).toLowerCase(); + data = elem.getAttribute( name ); + + if ( typeof data === "string" ) { + try { + data = getData( data ); + } catch ( e ) {} + + // Make sure we set the data so it isn't changed later + dataUser.set( elem, key, data ); + } else { + data = undefined; + } + } + return data; +} + +jQuery.extend( { + hasData: function( elem ) { + return dataUser.hasData( elem ) || dataPriv.hasData( elem ); + }, + + data: function( elem, name, data ) { + return dataUser.access( elem, name, data ); + }, + + removeData: function( elem, name ) { + dataUser.remove( elem, name ); + }, + + // TODO: Now that all calls to _data and _removeData have been replaced + // with direct calls to dataPriv methods, these can be deprecated. + _data: function( elem, name, data ) { + return dataPriv.access( elem, name, data ); + }, + + _removeData: function( elem, name ) { + dataPriv.remove( elem, name ); + } +} ); + +jQuery.fn.extend( { + data: function( key, value ) { + var i, name, data, + elem = this[ 0 ], + attrs = elem && elem.attributes; + + // Gets all values + if ( key === undefined ) { + if ( this.length ) { + data = dataUser.get( elem ); + + if ( elem.nodeType === 1 && !dataPriv.get( elem, "hasDataAttrs" ) ) { + i = attrs.length; + while ( i-- ) { + + // Support: IE 11 only + // The attrs elements can be null (#14894) + if ( attrs[ i ] ) { + name = attrs[ i ].name; + if ( name.indexOf( "data-" ) === 0 ) { + name = camelCase( name.slice( 5 ) ); + dataAttr( elem, name, data[ name ] ); + } + } + } + dataPriv.set( elem, "hasDataAttrs", true ); + } + } + + return data; + } + + // Sets multiple values + if ( typeof key === "object" ) { + return this.each( function() { + dataUser.set( this, key ); + } ); + } + + return access( this, function( value ) { + var data; + + // The calling jQuery object (element matches) is not empty + // (and therefore has an element appears at this[ 0 ]) and the + // `value` parameter was not undefined. An empty jQuery object + // will result in `undefined` for elem = this[ 0 ] which will + // throw an exception if an attempt to read a data cache is made. + if ( elem && value === undefined ) { + + // Attempt to get data from the cache + // The key will always be camelCased in Data + data = dataUser.get( elem, key ); + if ( data !== undefined ) { + return data; + } + + // Attempt to "discover" the data in + // HTML5 custom data-* attrs + data = dataAttr( elem, key ); + if ( data !== undefined ) { + return data; + } + + // We tried really hard, but the data doesn't exist. + return; + } + + // Set the data... + this.each( function() { + + // We always store the camelCased key + dataUser.set( this, key, value ); + } ); + }, null, value, arguments.length > 1, null, true ); + }, + + removeData: function( key ) { + return this.each( function() { + dataUser.remove( this, key ); + } ); + } +} ); + + +jQuery.extend( { + queue: function( elem, type, data ) { + var queue; + + if ( elem ) { + type = ( type || "fx" ) + "queue"; + queue = dataPriv.get( elem, type ); + + // Speed up dequeue by getting out quickly if this is just a lookup + if ( data ) { + if ( !queue || Array.isArray( data ) ) { + queue = dataPriv.access( elem, type, jQuery.makeArray( data ) ); + } else { + queue.push( data ); + } + } + return queue || []; + } + }, + + dequeue: function( elem, type ) { + type = type || "fx"; + + var queue = jQuery.queue( elem, type ), + startLength = queue.length, + fn = queue.shift(), + hooks = jQuery._queueHooks( elem, type ), + next = function() { + jQuery.dequeue( elem, type ); + }; + + // If the fx queue is dequeued, always remove the progress sentinel + if ( fn === "inprogress" ) { + fn = queue.shift(); + startLength--; + } + + if ( fn ) { + + // Add a progress sentinel to prevent the fx queue from being + // automatically dequeued + if ( type === "fx" ) { + queue.unshift( "inprogress" ); + } + + // Clear up the last queue stop function + delete hooks.stop; + fn.call( elem, next, hooks ); + } + + if ( !startLength && hooks ) { + hooks.empty.fire(); + } + }, + + // Not public - generate a queueHooks object, or return the current one + _queueHooks: function( elem, type ) { + var key = type + "queueHooks"; + return dataPriv.get( elem, key ) || dataPriv.access( elem, key, { + empty: jQuery.Callbacks( "once memory" ).add( function() { + dataPriv.remove( elem, [ type + "queue", key ] ); + } ) + } ); + } +} ); + +jQuery.fn.extend( { + queue: function( type, data ) { + var setter = 2; + + if ( typeof type !== "string" ) { + data = type; + type = "fx"; + setter--; + } + + if ( arguments.length < setter ) { + return jQuery.queue( this[ 0 ], type ); + } + + return data === undefined ? + this : + this.each( function() { + var queue = jQuery.queue( this, type, data ); + + // Ensure a hooks for this queue + jQuery._queueHooks( this, type ); + + if ( type === "fx" && queue[ 0 ] !== "inprogress" ) { + jQuery.dequeue( this, type ); + } + } ); + }, + dequeue: function( type ) { + return this.each( function() { + jQuery.dequeue( this, type ); + } ); + }, + clearQueue: function( type ) { + return this.queue( type || "fx", [] ); + }, + + // Get a promise resolved when queues of a certain type + // are emptied (fx is the type by default) + promise: function( type, obj ) { + var tmp, + count = 1, + defer = jQuery.Deferred(), + elements = this, + i = this.length, + resolve = function() { + if ( !( --count ) ) { + defer.resolveWith( elements, [ elements ] ); + } + }; + + if ( typeof type !== "string" ) { + obj = type; + type = undefined; + } + type = type || "fx"; + + while ( i-- ) { + tmp = dataPriv.get( elements[ i ], type + "queueHooks" ); + if ( tmp && tmp.empty ) { + count++; + tmp.empty.add( resolve ); + } + } + resolve(); + return defer.promise( obj ); + } +} ); +var pnum = ( /[+-]?(?:\d*\.|)\d+(?:[eE][+-]?\d+|)/ ).source; + +var rcssNum = new RegExp( "^(?:([+-])=|)(" + pnum + ")([a-z%]*)$", "i" ); + + +var cssExpand = [ "Top", "Right", "Bottom", "Left" ]; + +var documentElement = document.documentElement; + + + + var isAttached = function( elem ) { + return jQuery.contains( elem.ownerDocument, elem ); + }, + composed = { composed: true }; + + // Support: IE 9 - 11+, Edge 12 - 18+, iOS 10.0 - 10.2 only + // Check attachment across shadow DOM boundaries when possible (gh-3504) + // Support: iOS 10.0-10.2 only + // Early iOS 10 versions support `attachShadow` but not `getRootNode`, + // leading to errors. We need to check for `getRootNode`. + if ( documentElement.getRootNode ) { + isAttached = function( elem ) { + return jQuery.contains( elem.ownerDocument, elem ) || + elem.getRootNode( composed ) === elem.ownerDocument; + }; + } +var isHiddenWithinTree = function( elem, el ) { + + // isHiddenWithinTree might be called from jQuery#filter function; + // in that case, element will be second argument + elem = el || elem; + + // Inline style trumps all + return elem.style.display === "none" || + elem.style.display === "" && + + // Otherwise, check computed style + // Support: Firefox <=43 - 45 + // Disconnected elements can have computed display: none, so first confirm that elem is + // in the document. + isAttached( elem ) && + + jQuery.css( elem, "display" ) === "none"; + }; + + + +function adjustCSS( elem, prop, valueParts, tween ) { + var adjusted, scale, + maxIterations = 20, + currentValue = tween ? + function() { + return tween.cur(); + } : + function() { + return jQuery.css( elem, prop, "" ); + }, + initial = currentValue(), + unit = valueParts && valueParts[ 3 ] || ( jQuery.cssNumber[ prop ] ? "" : "px" ), + + // Starting value computation is required for potential unit mismatches + initialInUnit = elem.nodeType && + ( jQuery.cssNumber[ prop ] || unit !== "px" && +initial ) && + rcssNum.exec( jQuery.css( elem, prop ) ); + + if ( initialInUnit && initialInUnit[ 3 ] !== unit ) { + + // Support: Firefox <=54 + // Halve the iteration target value to prevent interference from CSS upper bounds (gh-2144) + initial = initial / 2; + + // Trust units reported by jQuery.css + unit = unit || initialInUnit[ 3 ]; + + // Iteratively approximate from a nonzero starting point + initialInUnit = +initial || 1; + + while ( maxIterations-- ) { + + // Evaluate and update our best guess (doubling guesses that zero out). + // Finish if the scale equals or crosses 1 (making the old*new product non-positive). + jQuery.style( elem, prop, initialInUnit + unit ); + if ( ( 1 - scale ) * ( 1 - ( scale = currentValue() / initial || 0.5 ) ) <= 0 ) { + maxIterations = 0; + } + initialInUnit = initialInUnit / scale; + + } + + initialInUnit = initialInUnit * 2; + jQuery.style( elem, prop, initialInUnit + unit ); + + // Make sure we update the tween properties later on + valueParts = valueParts || []; + } + + if ( valueParts ) { + initialInUnit = +initialInUnit || +initial || 0; + + // Apply relative offset (+=/-=) if specified + adjusted = valueParts[ 1 ] ? + initialInUnit + ( valueParts[ 1 ] + 1 ) * valueParts[ 2 ] : + +valueParts[ 2 ]; + if ( tween ) { + tween.unit = unit; + tween.start = initialInUnit; + tween.end = adjusted; + } + } + return adjusted; +} + + +var defaultDisplayMap = {}; + +function getDefaultDisplay( elem ) { + var temp, + doc = elem.ownerDocument, + nodeName = elem.nodeName, + display = defaultDisplayMap[ nodeName ]; + + if ( display ) { + return display; + } + + temp = doc.body.appendChild( doc.createElement( nodeName ) ); + display = jQuery.css( temp, "display" ); + + temp.parentNode.removeChild( temp ); + + if ( display === "none" ) { + display = "block"; + } + defaultDisplayMap[ nodeName ] = display; + + return display; +} + +function showHide( elements, show ) { + var display, elem, + values = [], + index = 0, + length = elements.length; + + // Determine new display value for elements that need to change + for ( ; index < length; index++ ) { + elem = elements[ index ]; + if ( !elem.style ) { + continue; + } + + display = elem.style.display; + if ( show ) { + + // Since we force visibility upon cascade-hidden elements, an immediate (and slow) + // check is required in this first loop unless we have a nonempty display value (either + // inline or about-to-be-restored) + if ( display === "none" ) { + values[ index ] = dataPriv.get( elem, "display" ) || null; + if ( !values[ index ] ) { + elem.style.display = ""; + } + } + if ( elem.style.display === "" && isHiddenWithinTree( elem ) ) { + values[ index ] = getDefaultDisplay( elem ); + } + } else { + if ( display !== "none" ) { + values[ index ] = "none"; + + // Remember what we're overwriting + dataPriv.set( elem, "display", display ); + } + } + } + + // Set the display of the elements in a second loop to avoid constant reflow + for ( index = 0; index < length; index++ ) { + if ( values[ index ] != null ) { + elements[ index ].style.display = values[ index ]; + } + } + + return elements; +} + +jQuery.fn.extend( { + show: function() { + return showHide( this, true ); + }, + hide: function() { + return showHide( this ); + }, + toggle: function( state ) { + if ( typeof state === "boolean" ) { + return state ? this.show() : this.hide(); + } + + return this.each( function() { + if ( isHiddenWithinTree( this ) ) { + jQuery( this ).show(); + } else { + jQuery( this ).hide(); + } + } ); + } +} ); +var rcheckableType = ( /^(?:checkbox|radio)$/i ); + +var rtagName = ( /<([a-z][^\/\0>\x20\t\r\n\f]*)/i ); + +var rscriptType = ( /^$|^module$|\/(?:java|ecma)script/i ); + + + +( function() { + var fragment = document.createDocumentFragment(), + div = fragment.appendChild( document.createElement( "div" ) ), + input = document.createElement( "input" ); + + // Support: Android 4.0 - 4.3 only + // Check state lost if the name is set (#11217) + // Support: Windows Web Apps (WWA) + // `name` and `type` must use .setAttribute for WWA (#14901) + input.setAttribute( "type", "radio" ); + input.setAttribute( "checked", "checked" ); + input.setAttribute( "name", "t" ); + + div.appendChild( input ); + + // Support: Android <=4.1 only + // Older WebKit doesn't clone checked state correctly in fragments + support.checkClone = div.cloneNode( true ).cloneNode( true ).lastChild.checked; + + // Support: IE <=11 only + // Make sure textarea (and checkbox) defaultValue is properly cloned + div.innerHTML = ""; + support.noCloneChecked = !!div.cloneNode( true ).lastChild.defaultValue; + + // Support: IE <=9 only + // IE <=9 replaces "; + support.option = !!div.lastChild; +} )(); + + +// We have to close these tags to support XHTML (#13200) +var wrapMap = { + + // XHTML parsers do not magically insert elements in the + // same way that tag soup parsers do. So we cannot shorten + // this by omitting or other required elements. + thead: [ 1, "", "
" ], + col: [ 2, "", "
" ], + tr: [ 2, "", "
" ], + td: [ 3, "", "
" ], + + _default: [ 0, "", "" ] +}; + +wrapMap.tbody = wrapMap.tfoot = wrapMap.colgroup = wrapMap.caption = wrapMap.thead; +wrapMap.th = wrapMap.td; + +// Support: IE <=9 only +if ( !support.option ) { + wrapMap.optgroup = wrapMap.option = [ 1, "" ]; +} + + +function getAll( context, tag ) { + + // Support: IE <=9 - 11 only + // Use typeof to avoid zero-argument method invocation on host objects (#15151) + var ret; + + if ( typeof context.getElementsByTagName !== "undefined" ) { + ret = context.getElementsByTagName( tag || "*" ); + + } else if ( typeof context.querySelectorAll !== "undefined" ) { + ret = context.querySelectorAll( tag || "*" ); + + } else { + ret = []; + } + + if ( tag === undefined || tag && nodeName( context, tag ) ) { + return jQuery.merge( [ context ], ret ); + } + + return ret; +} + + +// Mark scripts as having already been evaluated +function setGlobalEval( elems, refElements ) { + var i = 0, + l = elems.length; + + for ( ; i < l; i++ ) { + dataPriv.set( + elems[ i ], + "globalEval", + !refElements || dataPriv.get( refElements[ i ], "globalEval" ) + ); + } +} + + +var rhtml = /<|&#?\w+;/; + +function buildFragment( elems, context, scripts, selection, ignored ) { + var elem, tmp, tag, wrap, attached, j, + fragment = context.createDocumentFragment(), + nodes = [], + i = 0, + l = elems.length; + + for ( ; i < l; i++ ) { + elem = elems[ i ]; + + if ( elem || elem === 0 ) { + + // Add nodes directly + if ( toType( elem ) === "object" ) { + + // Support: Android <=4.0 only, PhantomJS 1 only + // push.apply(_, arraylike) throws on ancient WebKit + jQuery.merge( nodes, elem.nodeType ? [ elem ] : elem ); + + // Convert non-html into a text node + } else if ( !rhtml.test( elem ) ) { + nodes.push( context.createTextNode( elem ) ); + + // Convert html into DOM nodes + } else { + tmp = tmp || fragment.appendChild( context.createElement( "div" ) ); + + // Deserialize a standard representation + tag = ( rtagName.exec( elem ) || [ "", "" ] )[ 1 ].toLowerCase(); + wrap = wrapMap[ tag ] || wrapMap._default; + tmp.innerHTML = wrap[ 1 ] + jQuery.htmlPrefilter( elem ) + wrap[ 2 ]; + + // Descend through wrappers to the right content + j = wrap[ 0 ]; + while ( j-- ) { + tmp = tmp.lastChild; + } + + // Support: Android <=4.0 only, PhantomJS 1 only + // push.apply(_, arraylike) throws on ancient WebKit + jQuery.merge( nodes, tmp.childNodes ); + + // Remember the top-level container + tmp = fragment.firstChild; + + // Ensure the created nodes are orphaned (#12392) + tmp.textContent = ""; + } + } + } + + // Remove wrapper from fragment + fragment.textContent = ""; + + i = 0; + while ( ( elem = nodes[ i++ ] ) ) { + + // Skip elements already in the context collection (trac-4087) + if ( selection && jQuery.inArray( elem, selection ) > -1 ) { + if ( ignored ) { + ignored.push( elem ); + } + continue; + } + + attached = isAttached( elem ); + + // Append to fragment + tmp = getAll( fragment.appendChild( elem ), "script" ); + + // Preserve script evaluation history + if ( attached ) { + setGlobalEval( tmp ); + } + + // Capture executables + if ( scripts ) { + j = 0; + while ( ( elem = tmp[ j++ ] ) ) { + if ( rscriptType.test( elem.type || "" ) ) { + scripts.push( elem ); + } + } + } + } + + return fragment; +} + + +var + rkeyEvent = /^key/, + rmouseEvent = /^(?:mouse|pointer|contextmenu|drag|drop)|click/, + rtypenamespace = /^([^.]*)(?:\.(.+)|)/; + +function returnTrue() { + return true; +} + +function returnFalse() { + return false; +} + +// Support: IE <=9 - 11+ +// focus() and blur() are asynchronous, except when they are no-op. +// So expect focus to be synchronous when the element is already active, +// and blur to be synchronous when the element is not already active. +// (focus and blur are always synchronous in other supported browsers, +// this just defines when we can count on it). +function expectSync( elem, type ) { + return ( elem === safeActiveElement() ) === ( type === "focus" ); +} + +// Support: IE <=9 only +// Accessing document.activeElement can throw unexpectedly +// https://bugs.jquery.com/ticket/13393 +function safeActiveElement() { + try { + return document.activeElement; + } catch ( err ) { } +} + +function on( elem, types, selector, data, fn, one ) { + var origFn, type; + + // Types can be a map of types/handlers + if ( typeof types === "object" ) { + + // ( types-Object, selector, data ) + if ( typeof selector !== "string" ) { + + // ( types-Object, data ) + data = data || selector; + selector = undefined; + } + for ( type in types ) { + on( elem, type, selector, data, types[ type ], one ); + } + return elem; + } + + if ( data == null && fn == null ) { + + // ( types, fn ) + fn = selector; + data = selector = undefined; + } else if ( fn == null ) { + if ( typeof selector === "string" ) { + + // ( types, selector, fn ) + fn = data; + data = undefined; + } else { + + // ( types, data, fn ) + fn = data; + data = selector; + selector = undefined; + } + } + if ( fn === false ) { + fn = returnFalse; + } else if ( !fn ) { + return elem; + } + + if ( one === 1 ) { + origFn = fn; + fn = function( event ) { + + // Can use an empty set, since event contains the info + jQuery().off( event ); + return origFn.apply( this, arguments ); + }; + + // Use same guid so caller can remove using origFn + fn.guid = origFn.guid || ( origFn.guid = jQuery.guid++ ); + } + return elem.each( function() { + jQuery.event.add( this, types, fn, data, selector ); + } ); +} + +/* + * Helper functions for managing events -- not part of the public interface. + * Props to Dean Edwards' addEvent library for many of the ideas. + */ +jQuery.event = { + + global: {}, + + add: function( elem, types, handler, data, selector ) { + + var handleObjIn, eventHandle, tmp, + events, t, handleObj, + special, handlers, type, namespaces, origType, + elemData = dataPriv.get( elem ); + + // Only attach events to objects that accept data + if ( !acceptData( elem ) ) { + return; + } + + // Caller can pass in an object of custom data in lieu of the handler + if ( handler.handler ) { + handleObjIn = handler; + handler = handleObjIn.handler; + selector = handleObjIn.selector; + } + + // Ensure that invalid selectors throw exceptions at attach time + // Evaluate against documentElement in case elem is a non-element node (e.g., document) + if ( selector ) { + jQuery.find.matchesSelector( documentElement, selector ); + } + + // Make sure that the handler has a unique ID, used to find/remove it later + if ( !handler.guid ) { + handler.guid = jQuery.guid++; + } + + // Init the element's event structure and main handler, if this is the first + if ( !( events = elemData.events ) ) { + events = elemData.events = Object.create( null ); + } + if ( !( eventHandle = elemData.handle ) ) { + eventHandle = elemData.handle = function( e ) { + + // Discard the second event of a jQuery.event.trigger() and + // when an event is called after a page has unloaded + return typeof jQuery !== "undefined" && jQuery.event.triggered !== e.type ? + jQuery.event.dispatch.apply( elem, arguments ) : undefined; + }; + } + + // Handle multiple events separated by a space + types = ( types || "" ).match( rnothtmlwhite ) || [ "" ]; + t = types.length; + while ( t-- ) { + tmp = rtypenamespace.exec( types[ t ] ) || []; + type = origType = tmp[ 1 ]; + namespaces = ( tmp[ 2 ] || "" ).split( "." ).sort(); + + // There *must* be a type, no attaching namespace-only handlers + if ( !type ) { + continue; + } + + // If event changes its type, use the special event handlers for the changed type + special = jQuery.event.special[ type ] || {}; + + // If selector defined, determine special event api type, otherwise given type + type = ( selector ? special.delegateType : special.bindType ) || type; + + // Update special based on newly reset type + special = jQuery.event.special[ type ] || {}; + + // handleObj is passed to all event handlers + handleObj = jQuery.extend( { + type: type, + origType: origType, + data: data, + handler: handler, + guid: handler.guid, + selector: selector, + needsContext: selector && jQuery.expr.match.needsContext.test( selector ), + namespace: namespaces.join( "." ) + }, handleObjIn ); + + // Init the event handler queue if we're the first + if ( !( handlers = events[ type ] ) ) { + handlers = events[ type ] = []; + handlers.delegateCount = 0; + + // Only use addEventListener if the special events handler returns false + if ( !special.setup || + special.setup.call( elem, data, namespaces, eventHandle ) === false ) { + + if ( elem.addEventListener ) { + elem.addEventListener( type, eventHandle ); + } + } + } + + if ( special.add ) { + special.add.call( elem, handleObj ); + + if ( !handleObj.handler.guid ) { + handleObj.handler.guid = handler.guid; + } + } + + // Add to the element's handler list, delegates in front + if ( selector ) { + handlers.splice( handlers.delegateCount++, 0, handleObj ); + } else { + handlers.push( handleObj ); + } + + // Keep track of which events have ever been used, for event optimization + jQuery.event.global[ type ] = true; + } + + }, + + // Detach an event or set of events from an element + remove: function( elem, types, handler, selector, mappedTypes ) { + + var j, origCount, tmp, + events, t, handleObj, + special, handlers, type, namespaces, origType, + elemData = dataPriv.hasData( elem ) && dataPriv.get( elem ); + + if ( !elemData || !( events = elemData.events ) ) { + return; + } + + // Once for each type.namespace in types; type may be omitted + types = ( types || "" ).match( rnothtmlwhite ) || [ "" ]; + t = types.length; + while ( t-- ) { + tmp = rtypenamespace.exec( types[ t ] ) || []; + type = origType = tmp[ 1 ]; + namespaces = ( tmp[ 2 ] || "" ).split( "." ).sort(); + + // Unbind all events (on this namespace, if provided) for the element + if ( !type ) { + for ( type in events ) { + jQuery.event.remove( elem, type + types[ t ], handler, selector, true ); + } + continue; + } + + special = jQuery.event.special[ type ] || {}; + type = ( selector ? special.delegateType : special.bindType ) || type; + handlers = events[ type ] || []; + tmp = tmp[ 2 ] && + new RegExp( "(^|\\.)" + namespaces.join( "\\.(?:.*\\.|)" ) + "(\\.|$)" ); + + // Remove matching events + origCount = j = handlers.length; + while ( j-- ) { + handleObj = handlers[ j ]; + + if ( ( mappedTypes || origType === handleObj.origType ) && + ( !handler || handler.guid === handleObj.guid ) && + ( !tmp || tmp.test( handleObj.namespace ) ) && + ( !selector || selector === handleObj.selector || + selector === "**" && handleObj.selector ) ) { + handlers.splice( j, 1 ); + + if ( handleObj.selector ) { + handlers.delegateCount--; + } + if ( special.remove ) { + special.remove.call( elem, handleObj ); + } + } + } + + // Remove generic event handler if we removed something and no more handlers exist + // (avoids potential for endless recursion during removal of special event handlers) + if ( origCount && !handlers.length ) { + if ( !special.teardown || + special.teardown.call( elem, namespaces, elemData.handle ) === false ) { + + jQuery.removeEvent( elem, type, elemData.handle ); + } + + delete events[ type ]; + } + } + + // Remove data and the expando if it's no longer used + if ( jQuery.isEmptyObject( events ) ) { + dataPriv.remove( elem, "handle events" ); + } + }, + + dispatch: function( nativeEvent ) { + + var i, j, ret, matched, handleObj, handlerQueue, + args = new Array( arguments.length ), + + // Make a writable jQuery.Event from the native event object + event = jQuery.event.fix( nativeEvent ), + + handlers = ( + dataPriv.get( this, "events" ) || Object.create( null ) + )[ event.type ] || [], + special = jQuery.event.special[ event.type ] || {}; + + // Use the fix-ed jQuery.Event rather than the (read-only) native event + args[ 0 ] = event; + + for ( i = 1; i < arguments.length; i++ ) { + args[ i ] = arguments[ i ]; + } + + event.delegateTarget = this; + + // Call the preDispatch hook for the mapped type, and let it bail if desired + if ( special.preDispatch && special.preDispatch.call( this, event ) === false ) { + return; + } + + // Determine handlers + handlerQueue = jQuery.event.handlers.call( this, event, handlers ); + + // Run delegates first; they may want to stop propagation beneath us + i = 0; + while ( ( matched = handlerQueue[ i++ ] ) && !event.isPropagationStopped() ) { + event.currentTarget = matched.elem; + + j = 0; + while ( ( handleObj = matched.handlers[ j++ ] ) && + !event.isImmediatePropagationStopped() ) { + + // If the event is namespaced, then each handler is only invoked if it is + // specially universal or its namespaces are a superset of the event's. + if ( !event.rnamespace || handleObj.namespace === false || + event.rnamespace.test( handleObj.namespace ) ) { + + event.handleObj = handleObj; + event.data = handleObj.data; + + ret = ( ( jQuery.event.special[ handleObj.origType ] || {} ).handle || + handleObj.handler ).apply( matched.elem, args ); + + if ( ret !== undefined ) { + if ( ( event.result = ret ) === false ) { + event.preventDefault(); + event.stopPropagation(); + } + } + } + } + } + + // Call the postDispatch hook for the mapped type + if ( special.postDispatch ) { + special.postDispatch.call( this, event ); + } + + return event.result; + }, + + handlers: function( event, handlers ) { + var i, handleObj, sel, matchedHandlers, matchedSelectors, + handlerQueue = [], + delegateCount = handlers.delegateCount, + cur = event.target; + + // Find delegate handlers + if ( delegateCount && + + // Support: IE <=9 + // Black-hole SVG instance trees (trac-13180) + cur.nodeType && + + // Support: Firefox <=42 + // Suppress spec-violating clicks indicating a non-primary pointer button (trac-3861) + // https://www.w3.org/TR/DOM-Level-3-Events/#event-type-click + // Support: IE 11 only + // ...but not arrow key "clicks" of radio inputs, which can have `button` -1 (gh-2343) + !( event.type === "click" && event.button >= 1 ) ) { + + for ( ; cur !== this; cur = cur.parentNode || this ) { + + // Don't check non-elements (#13208) + // Don't process clicks on disabled elements (#6911, #8165, #11382, #11764) + if ( cur.nodeType === 1 && !( event.type === "click" && cur.disabled === true ) ) { + matchedHandlers = []; + matchedSelectors = {}; + for ( i = 0; i < delegateCount; i++ ) { + handleObj = handlers[ i ]; + + // Don't conflict with Object.prototype properties (#13203) + sel = handleObj.selector + " "; + + if ( matchedSelectors[ sel ] === undefined ) { + matchedSelectors[ sel ] = handleObj.needsContext ? + jQuery( sel, this ).index( cur ) > -1 : + jQuery.find( sel, this, null, [ cur ] ).length; + } + if ( matchedSelectors[ sel ] ) { + matchedHandlers.push( handleObj ); + } + } + if ( matchedHandlers.length ) { + handlerQueue.push( { elem: cur, handlers: matchedHandlers } ); + } + } + } + } + + // Add the remaining (directly-bound) handlers + cur = this; + if ( delegateCount < handlers.length ) { + handlerQueue.push( { elem: cur, handlers: handlers.slice( delegateCount ) } ); + } + + return handlerQueue; + }, + + addProp: function( name, hook ) { + Object.defineProperty( jQuery.Event.prototype, name, { + enumerable: true, + configurable: true, + + get: isFunction( hook ) ? + function() { + if ( this.originalEvent ) { + return hook( this.originalEvent ); + } + } : + function() { + if ( this.originalEvent ) { + return this.originalEvent[ name ]; + } + }, + + set: function( value ) { + Object.defineProperty( this, name, { + enumerable: true, + configurable: true, + writable: true, + value: value + } ); + } + } ); + }, + + fix: function( originalEvent ) { + return originalEvent[ jQuery.expando ] ? + originalEvent : + new jQuery.Event( originalEvent ); + }, + + special: { + load: { + + // Prevent triggered image.load events from bubbling to window.load + noBubble: true + }, + click: { + + // Utilize native event to ensure correct state for checkable inputs + setup: function( data ) { + + // For mutual compressibility with _default, replace `this` access with a local var. + // `|| data` is dead code meant only to preserve the variable through minification. + var el = this || data; + + // Claim the first handler + if ( rcheckableType.test( el.type ) && + el.click && nodeName( el, "input" ) ) { + + // dataPriv.set( el, "click", ... ) + leverageNative( el, "click", returnTrue ); + } + + // Return false to allow normal processing in the caller + return false; + }, + trigger: function( data ) { + + // For mutual compressibility with _default, replace `this` access with a local var. + // `|| data` is dead code meant only to preserve the variable through minification. + var el = this || data; + + // Force setup before triggering a click + if ( rcheckableType.test( el.type ) && + el.click && nodeName( el, "input" ) ) { + + leverageNative( el, "click" ); + } + + // Return non-false to allow normal event-path propagation + return true; + }, + + // For cross-browser consistency, suppress native .click() on links + // Also prevent it if we're currently inside a leveraged native-event stack + _default: function( event ) { + var target = event.target; + return rcheckableType.test( target.type ) && + target.click && nodeName( target, "input" ) && + dataPriv.get( target, "click" ) || + nodeName( target, "a" ); + } + }, + + beforeunload: { + postDispatch: function( event ) { + + // Support: Firefox 20+ + // Firefox doesn't alert if the returnValue field is not set. + if ( event.result !== undefined && event.originalEvent ) { + event.originalEvent.returnValue = event.result; + } + } + } + } +}; + +// Ensure the presence of an event listener that handles manually-triggered +// synthetic events by interrupting progress until reinvoked in response to +// *native* events that it fires directly, ensuring that state changes have +// already occurred before other listeners are invoked. +function leverageNative( el, type, expectSync ) { + + // Missing expectSync indicates a trigger call, which must force setup through jQuery.event.add + if ( !expectSync ) { + if ( dataPriv.get( el, type ) === undefined ) { + jQuery.event.add( el, type, returnTrue ); + } + return; + } + + // Register the controller as a special universal handler for all event namespaces + dataPriv.set( el, type, false ); + jQuery.event.add( el, type, { + namespace: false, + handler: function( event ) { + var notAsync, result, + saved = dataPriv.get( this, type ); + + if ( ( event.isTrigger & 1 ) && this[ type ] ) { + + // Interrupt processing of the outer synthetic .trigger()ed event + // Saved data should be false in such cases, but might be a leftover capture object + // from an async native handler (gh-4350) + if ( !saved.length ) { + + // Store arguments for use when handling the inner native event + // There will always be at least one argument (an event object), so this array + // will not be confused with a leftover capture object. + saved = slice.call( arguments ); + dataPriv.set( this, type, saved ); + + // Trigger the native event and capture its result + // Support: IE <=9 - 11+ + // focus() and blur() are asynchronous + notAsync = expectSync( this, type ); + this[ type ](); + result = dataPriv.get( this, type ); + if ( saved !== result || notAsync ) { + dataPriv.set( this, type, false ); + } else { + result = {}; + } + if ( saved !== result ) { + + // Cancel the outer synthetic event + event.stopImmediatePropagation(); + event.preventDefault(); + return result.value; + } + + // If this is an inner synthetic event for an event with a bubbling surrogate + // (focus or blur), assume that the surrogate already propagated from triggering the + // native event and prevent that from happening again here. + // This technically gets the ordering wrong w.r.t. to `.trigger()` (in which the + // bubbling surrogate propagates *after* the non-bubbling base), but that seems + // less bad than duplication. + } else if ( ( jQuery.event.special[ type ] || {} ).delegateType ) { + event.stopPropagation(); + } + + // If this is a native event triggered above, everything is now in order + // Fire an inner synthetic event with the original arguments + } else if ( saved.length ) { + + // ...and capture the result + dataPriv.set( this, type, { + value: jQuery.event.trigger( + + // Support: IE <=9 - 11+ + // Extend with the prototype to reset the above stopImmediatePropagation() + jQuery.extend( saved[ 0 ], jQuery.Event.prototype ), + saved.slice( 1 ), + this + ) + } ); + + // Abort handling of the native event + event.stopImmediatePropagation(); + } + } + } ); +} + +jQuery.removeEvent = function( elem, type, handle ) { + + // This "if" is needed for plain objects + if ( elem.removeEventListener ) { + elem.removeEventListener( type, handle ); + } +}; + +jQuery.Event = function( src, props ) { + + // Allow instantiation without the 'new' keyword + if ( !( this instanceof jQuery.Event ) ) { + return new jQuery.Event( src, props ); + } + + // Event object + if ( src && src.type ) { + this.originalEvent = src; + this.type = src.type; + + // Events bubbling up the document may have been marked as prevented + // by a handler lower down the tree; reflect the correct value. + this.isDefaultPrevented = src.defaultPrevented || + src.defaultPrevented === undefined && + + // Support: Android <=2.3 only + src.returnValue === false ? + returnTrue : + returnFalse; + + // Create target properties + // Support: Safari <=6 - 7 only + // Target should not be a text node (#504, #13143) + this.target = ( src.target && src.target.nodeType === 3 ) ? + src.target.parentNode : + src.target; + + this.currentTarget = src.currentTarget; + this.relatedTarget = src.relatedTarget; + + // Event type + } else { + this.type = src; + } + + // Put explicitly provided properties onto the event object + if ( props ) { + jQuery.extend( this, props ); + } + + // Create a timestamp if incoming event doesn't have one + this.timeStamp = src && src.timeStamp || Date.now(); + + // Mark it as fixed + this[ jQuery.expando ] = true; +}; + +// jQuery.Event is based on DOM3 Events as specified by the ECMAScript Language Binding +// https://www.w3.org/TR/2003/WD-DOM-Level-3-Events-20030331/ecma-script-binding.html +jQuery.Event.prototype = { + constructor: jQuery.Event, + isDefaultPrevented: returnFalse, + isPropagationStopped: returnFalse, + isImmediatePropagationStopped: returnFalse, + isSimulated: false, + + preventDefault: function() { + var e = this.originalEvent; + + this.isDefaultPrevented = returnTrue; + + if ( e && !this.isSimulated ) { + e.preventDefault(); + } + }, + stopPropagation: function() { + var e = this.originalEvent; + + this.isPropagationStopped = returnTrue; + + if ( e && !this.isSimulated ) { + e.stopPropagation(); + } + }, + stopImmediatePropagation: function() { + var e = this.originalEvent; + + this.isImmediatePropagationStopped = returnTrue; + + if ( e && !this.isSimulated ) { + e.stopImmediatePropagation(); + } + + this.stopPropagation(); + } +}; + +// Includes all common event props including KeyEvent and MouseEvent specific props +jQuery.each( { + altKey: true, + bubbles: true, + cancelable: true, + changedTouches: true, + ctrlKey: true, + detail: true, + eventPhase: true, + metaKey: true, + pageX: true, + pageY: true, + shiftKey: true, + view: true, + "char": true, + code: true, + charCode: true, + key: true, + keyCode: true, + button: true, + buttons: true, + clientX: true, + clientY: true, + offsetX: true, + offsetY: true, + pointerId: true, + pointerType: true, + screenX: true, + screenY: true, + targetTouches: true, + toElement: true, + touches: true, + + which: function( event ) { + var button = event.button; + + // Add which for key events + if ( event.which == null && rkeyEvent.test( event.type ) ) { + return event.charCode != null ? event.charCode : event.keyCode; + } + + // Add which for click: 1 === left; 2 === middle; 3 === right + if ( !event.which && button !== undefined && rmouseEvent.test( event.type ) ) { + if ( button & 1 ) { + return 1; + } + + if ( button & 2 ) { + return 3; + } + + if ( button & 4 ) { + return 2; + } + + return 0; + } + + return event.which; + } +}, jQuery.event.addProp ); + +jQuery.each( { focus: "focusin", blur: "focusout" }, function( type, delegateType ) { + jQuery.event.special[ type ] = { + + // Utilize native event if possible so blur/focus sequence is correct + setup: function() { + + // Claim the first handler + // dataPriv.set( this, "focus", ... ) + // dataPriv.set( this, "blur", ... ) + leverageNative( this, type, expectSync ); + + // Return false to allow normal processing in the caller + return false; + }, + trigger: function() { + + // Force setup before trigger + leverageNative( this, type ); + + // Return non-false to allow normal event-path propagation + return true; + }, + + delegateType: delegateType + }; +} ); + +// Create mouseenter/leave events using mouseover/out and event-time checks +// so that event delegation works in jQuery. +// Do the same for pointerenter/pointerleave and pointerover/pointerout +// +// Support: Safari 7 only +// Safari sends mouseenter too often; see: +// https://bugs.chromium.org/p/chromium/issues/detail?id=470258 +// for the description of the bug (it existed in older Chrome versions as well). +jQuery.each( { + mouseenter: "mouseover", + mouseleave: "mouseout", + pointerenter: "pointerover", + pointerleave: "pointerout" +}, function( orig, fix ) { + jQuery.event.special[ orig ] = { + delegateType: fix, + bindType: fix, + + handle: function( event ) { + var ret, + target = this, + related = event.relatedTarget, + handleObj = event.handleObj; + + // For mouseenter/leave call the handler if related is outside the target. + // NB: No relatedTarget if the mouse left/entered the browser window + if ( !related || ( related !== target && !jQuery.contains( target, related ) ) ) { + event.type = handleObj.origType; + ret = handleObj.handler.apply( this, arguments ); + event.type = fix; + } + return ret; + } + }; +} ); + +jQuery.fn.extend( { + + on: function( types, selector, data, fn ) { + return on( this, types, selector, data, fn ); + }, + one: function( types, selector, data, fn ) { + return on( this, types, selector, data, fn, 1 ); + }, + off: function( types, selector, fn ) { + var handleObj, type; + if ( types && types.preventDefault && types.handleObj ) { + + // ( event ) dispatched jQuery.Event + handleObj = types.handleObj; + jQuery( types.delegateTarget ).off( + handleObj.namespace ? + handleObj.origType + "." + handleObj.namespace : + handleObj.origType, + handleObj.selector, + handleObj.handler + ); + return this; + } + if ( typeof types === "object" ) { + + // ( types-object [, selector] ) + for ( type in types ) { + this.off( type, selector, types[ type ] ); + } + return this; + } + if ( selector === false || typeof selector === "function" ) { + + // ( types [, fn] ) + fn = selector; + selector = undefined; + } + if ( fn === false ) { + fn = returnFalse; + } + return this.each( function() { + jQuery.event.remove( this, types, fn, selector ); + } ); + } +} ); + + +var + + // Support: IE <=10 - 11, Edge 12 - 13 only + // In IE/Edge using regex groups here causes severe slowdowns. + // See https://connect.microsoft.com/IE/feedback/details/1736512/ + rnoInnerhtml = /\s*$/g; + +// Prefer a tbody over its parent table for containing new rows +function manipulationTarget( elem, content ) { + if ( nodeName( elem, "table" ) && + nodeName( content.nodeType !== 11 ? content : content.firstChild, "tr" ) ) { + + return jQuery( elem ).children( "tbody" )[ 0 ] || elem; + } + + return elem; +} + +// Replace/restore the type attribute of script elements for safe DOM manipulation +function disableScript( elem ) { + elem.type = ( elem.getAttribute( "type" ) !== null ) + "/" + elem.type; + return elem; +} +function restoreScript( elem ) { + if ( ( elem.type || "" ).slice( 0, 5 ) === "true/" ) { + elem.type = elem.type.slice( 5 ); + } else { + elem.removeAttribute( "type" ); + } + + return elem; +} + +function cloneCopyEvent( src, dest ) { + var i, l, type, pdataOld, udataOld, udataCur, events; + + if ( dest.nodeType !== 1 ) { + return; + } + + // 1. Copy private data: events, handlers, etc. + if ( dataPriv.hasData( src ) ) { + pdataOld = dataPriv.get( src ); + events = pdataOld.events; + + if ( events ) { + dataPriv.remove( dest, "handle events" ); + + for ( type in events ) { + for ( i = 0, l = events[ type ].length; i < l; i++ ) { + jQuery.event.add( dest, type, events[ type ][ i ] ); + } + } + } + } + + // 2. Copy user data + if ( dataUser.hasData( src ) ) { + udataOld = dataUser.access( src ); + udataCur = jQuery.extend( {}, udataOld ); + + dataUser.set( dest, udataCur ); + } +} + +// Fix IE bugs, see support tests +function fixInput( src, dest ) { + var nodeName = dest.nodeName.toLowerCase(); + + // Fails to persist the checked state of a cloned checkbox or radio button. + if ( nodeName === "input" && rcheckableType.test( src.type ) ) { + dest.checked = src.checked; + + // Fails to return the selected option to the default selected state when cloning options + } else if ( nodeName === "input" || nodeName === "textarea" ) { + dest.defaultValue = src.defaultValue; + } +} + +function domManip( collection, args, callback, ignored ) { + + // Flatten any nested arrays + args = flat( args ); + + var fragment, first, scripts, hasScripts, node, doc, + i = 0, + l = collection.length, + iNoClone = l - 1, + value = args[ 0 ], + valueIsFunction = isFunction( value ); + + // We can't cloneNode fragments that contain checked, in WebKit + if ( valueIsFunction || + ( l > 1 && typeof value === "string" && + !support.checkClone && rchecked.test( value ) ) ) { + return collection.each( function( index ) { + var self = collection.eq( index ); + if ( valueIsFunction ) { + args[ 0 ] = value.call( this, index, self.html() ); + } + domManip( self, args, callback, ignored ); + } ); + } + + if ( l ) { + fragment = buildFragment( args, collection[ 0 ].ownerDocument, false, collection, ignored ); + first = fragment.firstChild; + + if ( fragment.childNodes.length === 1 ) { + fragment = first; + } + + // Require either new content or an interest in ignored elements to invoke the callback + if ( first || ignored ) { + scripts = jQuery.map( getAll( fragment, "script" ), disableScript ); + hasScripts = scripts.length; + + // Use the original fragment for the last item + // instead of the first because it can end up + // being emptied incorrectly in certain situations (#8070). + for ( ; i < l; i++ ) { + node = fragment; + + if ( i !== iNoClone ) { + node = jQuery.clone( node, true, true ); + + // Keep references to cloned scripts for later restoration + if ( hasScripts ) { + + // Support: Android <=4.0 only, PhantomJS 1 only + // push.apply(_, arraylike) throws on ancient WebKit + jQuery.merge( scripts, getAll( node, "script" ) ); + } + } + + callback.call( collection[ i ], node, i ); + } + + if ( hasScripts ) { + doc = scripts[ scripts.length - 1 ].ownerDocument; + + // Reenable scripts + jQuery.map( scripts, restoreScript ); + + // Evaluate executable scripts on first document insertion + for ( i = 0; i < hasScripts; i++ ) { + node = scripts[ i ]; + if ( rscriptType.test( node.type || "" ) && + !dataPriv.access( node, "globalEval" ) && + jQuery.contains( doc, node ) ) { + + if ( node.src && ( node.type || "" ).toLowerCase() !== "module" ) { + + // Optional AJAX dependency, but won't run scripts if not present + if ( jQuery._evalUrl && !node.noModule ) { + jQuery._evalUrl( node.src, { + nonce: node.nonce || node.getAttribute( "nonce" ) + }, doc ); + } + } else { + DOMEval( node.textContent.replace( rcleanScript, "" ), node, doc ); + } + } + } + } + } + } + + return collection; +} + +function remove( elem, selector, keepData ) { + var node, + nodes = selector ? jQuery.filter( selector, elem ) : elem, + i = 0; + + for ( ; ( node = nodes[ i ] ) != null; i++ ) { + if ( !keepData && node.nodeType === 1 ) { + jQuery.cleanData( getAll( node ) ); + } + + if ( node.parentNode ) { + if ( keepData && isAttached( node ) ) { + setGlobalEval( getAll( node, "script" ) ); + } + node.parentNode.removeChild( node ); + } + } + + return elem; +} + +jQuery.extend( { + htmlPrefilter: function( html ) { + return html; + }, + + clone: function( elem, dataAndEvents, deepDataAndEvents ) { + var i, l, srcElements, destElements, + clone = elem.cloneNode( true ), + inPage = isAttached( elem ); + + // Fix IE cloning issues + if ( !support.noCloneChecked && ( elem.nodeType === 1 || elem.nodeType === 11 ) && + !jQuery.isXMLDoc( elem ) ) { + + // We eschew Sizzle here for performance reasons: https://jsperf.com/getall-vs-sizzle/2 + destElements = getAll( clone ); + srcElements = getAll( elem ); + + for ( i = 0, l = srcElements.length; i < l; i++ ) { + fixInput( srcElements[ i ], destElements[ i ] ); + } + } + + // Copy the events from the original to the clone + if ( dataAndEvents ) { + if ( deepDataAndEvents ) { + srcElements = srcElements || getAll( elem ); + destElements = destElements || getAll( clone ); + + for ( i = 0, l = srcElements.length; i < l; i++ ) { + cloneCopyEvent( srcElements[ i ], destElements[ i ] ); + } + } else { + cloneCopyEvent( elem, clone ); + } + } + + // Preserve script evaluation history + destElements = getAll( clone, "script" ); + if ( destElements.length > 0 ) { + setGlobalEval( destElements, !inPage && getAll( elem, "script" ) ); + } + + // Return the cloned set + return clone; + }, + + cleanData: function( elems ) { + var data, elem, type, + special = jQuery.event.special, + i = 0; + + for ( ; ( elem = elems[ i ] ) !== undefined; i++ ) { + if ( acceptData( elem ) ) { + if ( ( data = elem[ dataPriv.expando ] ) ) { + if ( data.events ) { + for ( type in data.events ) { + if ( special[ type ] ) { + jQuery.event.remove( elem, type ); + + // This is a shortcut to avoid jQuery.event.remove's overhead + } else { + jQuery.removeEvent( elem, type, data.handle ); + } + } + } + + // Support: Chrome <=35 - 45+ + // Assign undefined instead of using delete, see Data#remove + elem[ dataPriv.expando ] = undefined; + } + if ( elem[ dataUser.expando ] ) { + + // Support: Chrome <=35 - 45+ + // Assign undefined instead of using delete, see Data#remove + elem[ dataUser.expando ] = undefined; + } + } + } + } +} ); + +jQuery.fn.extend( { + detach: function( selector ) { + return remove( this, selector, true ); + }, + + remove: function( selector ) { + return remove( this, selector ); + }, + + text: function( value ) { + return access( this, function( value ) { + return value === undefined ? + jQuery.text( this ) : + this.empty().each( function() { + if ( this.nodeType === 1 || this.nodeType === 11 || this.nodeType === 9 ) { + this.textContent = value; + } + } ); + }, null, value, arguments.length ); + }, + + append: function() { + return domManip( this, arguments, function( elem ) { + if ( this.nodeType === 1 || this.nodeType === 11 || this.nodeType === 9 ) { + var target = manipulationTarget( this, elem ); + target.appendChild( elem ); + } + } ); + }, + + prepend: function() { + return domManip( this, arguments, function( elem ) { + if ( this.nodeType === 1 || this.nodeType === 11 || this.nodeType === 9 ) { + var target = manipulationTarget( this, elem ); + target.insertBefore( elem, target.firstChild ); + } + } ); + }, + + before: function() { + return domManip( this, arguments, function( elem ) { + if ( this.parentNode ) { + this.parentNode.insertBefore( elem, this ); + } + } ); + }, + + after: function() { + return domManip( this, arguments, function( elem ) { + if ( this.parentNode ) { + this.parentNode.insertBefore( elem, this.nextSibling ); + } + } ); + }, + + empty: function() { + var elem, + i = 0; + + for ( ; ( elem = this[ i ] ) != null; i++ ) { + if ( elem.nodeType === 1 ) { + + // Prevent memory leaks + jQuery.cleanData( getAll( elem, false ) ); + + // Remove any remaining nodes + elem.textContent = ""; + } + } + + return this; + }, + + clone: function( dataAndEvents, deepDataAndEvents ) { + dataAndEvents = dataAndEvents == null ? false : dataAndEvents; + deepDataAndEvents = deepDataAndEvents == null ? dataAndEvents : deepDataAndEvents; + + return this.map( function() { + return jQuery.clone( this, dataAndEvents, deepDataAndEvents ); + } ); + }, + + html: function( value ) { + return access( this, function( value ) { + var elem = this[ 0 ] || {}, + i = 0, + l = this.length; + + if ( value === undefined && elem.nodeType === 1 ) { + return elem.innerHTML; + } + + // See if we can take a shortcut and just use innerHTML + if ( typeof value === "string" && !rnoInnerhtml.test( value ) && + !wrapMap[ ( rtagName.exec( value ) || [ "", "" ] )[ 1 ].toLowerCase() ] ) { + + value = jQuery.htmlPrefilter( value ); + + try { + for ( ; i < l; i++ ) { + elem = this[ i ] || {}; + + // Remove element nodes and prevent memory leaks + if ( elem.nodeType === 1 ) { + jQuery.cleanData( getAll( elem, false ) ); + elem.innerHTML = value; + } + } + + elem = 0; + + // If using innerHTML throws an exception, use the fallback method + } catch ( e ) {} + } + + if ( elem ) { + this.empty().append( value ); + } + }, null, value, arguments.length ); + }, + + replaceWith: function() { + var ignored = []; + + // Make the changes, replacing each non-ignored context element with the new content + return domManip( this, arguments, function( elem ) { + var parent = this.parentNode; + + if ( jQuery.inArray( this, ignored ) < 0 ) { + jQuery.cleanData( getAll( this ) ); + if ( parent ) { + parent.replaceChild( elem, this ); + } + } + + // Force callback invocation + }, ignored ); + } +} ); + +jQuery.each( { + appendTo: "append", + prependTo: "prepend", + insertBefore: "before", + insertAfter: "after", + replaceAll: "replaceWith" +}, function( name, original ) { + jQuery.fn[ name ] = function( selector ) { + var elems, + ret = [], + insert = jQuery( selector ), + last = insert.length - 1, + i = 0; + + for ( ; i <= last; i++ ) { + elems = i === last ? this : this.clone( true ); + jQuery( insert[ i ] )[ original ]( elems ); + + // Support: Android <=4.0 only, PhantomJS 1 only + // .get() because push.apply(_, arraylike) throws on ancient WebKit + push.apply( ret, elems.get() ); + } + + return this.pushStack( ret ); + }; +} ); +var rnumnonpx = new RegExp( "^(" + pnum + ")(?!px)[a-z%]+$", "i" ); + +var getStyles = function( elem ) { + + // Support: IE <=11 only, Firefox <=30 (#15098, #14150) + // IE throws on elements created in popups + // FF meanwhile throws on frame elements through "defaultView.getComputedStyle" + var view = elem.ownerDocument.defaultView; + + if ( !view || !view.opener ) { + view = window; + } + + return view.getComputedStyle( elem ); + }; + +var swap = function( elem, options, callback ) { + var ret, name, + old = {}; + + // Remember the old values, and insert the new ones + for ( name in options ) { + old[ name ] = elem.style[ name ]; + elem.style[ name ] = options[ name ]; + } + + ret = callback.call( elem ); + + // Revert the old values + for ( name in options ) { + elem.style[ name ] = old[ name ]; + } + + return ret; +}; + + +var rboxStyle = new RegExp( cssExpand.join( "|" ), "i" ); + + + +( function() { + + // Executing both pixelPosition & boxSizingReliable tests require only one layout + // so they're executed at the same time to save the second computation. + function computeStyleTests() { + + // This is a singleton, we need to execute it only once + if ( !div ) { + return; + } + + container.style.cssText = "position:absolute;left:-11111px;width:60px;" + + "margin-top:1px;padding:0;border:0"; + div.style.cssText = + "position:relative;display:block;box-sizing:border-box;overflow:scroll;" + + "margin:auto;border:1px;padding:1px;" + + "width:60%;top:1%"; + documentElement.appendChild( container ).appendChild( div ); + + var divStyle = window.getComputedStyle( div ); + pixelPositionVal = divStyle.top !== "1%"; + + // Support: Android 4.0 - 4.3 only, Firefox <=3 - 44 + reliableMarginLeftVal = roundPixelMeasures( divStyle.marginLeft ) === 12; + + // Support: Android 4.0 - 4.3 only, Safari <=9.1 - 10.1, iOS <=7.0 - 9.3 + // Some styles come back with percentage values, even though they shouldn't + div.style.right = "60%"; + pixelBoxStylesVal = roundPixelMeasures( divStyle.right ) === 36; + + // Support: IE 9 - 11 only + // Detect misreporting of content dimensions for box-sizing:border-box elements + boxSizingReliableVal = roundPixelMeasures( divStyle.width ) === 36; + + // Support: IE 9 only + // Detect overflow:scroll screwiness (gh-3699) + // Support: Chrome <=64 + // Don't get tricked when zoom affects offsetWidth (gh-4029) + div.style.position = "absolute"; + scrollboxSizeVal = roundPixelMeasures( div.offsetWidth / 3 ) === 12; + + documentElement.removeChild( container ); + + // Nullify the div so it wouldn't be stored in the memory and + // it will also be a sign that checks already performed + div = null; + } + + function roundPixelMeasures( measure ) { + return Math.round( parseFloat( measure ) ); + } + + var pixelPositionVal, boxSizingReliableVal, scrollboxSizeVal, pixelBoxStylesVal, + reliableTrDimensionsVal, reliableMarginLeftVal, + container = document.createElement( "div" ), + div = document.createElement( "div" ); + + // Finish early in limited (non-browser) environments + if ( !div.style ) { + return; + } + + // Support: IE <=9 - 11 only + // Style of cloned element affects source element cloned (#8908) + div.style.backgroundClip = "content-box"; + div.cloneNode( true ).style.backgroundClip = ""; + support.clearCloneStyle = div.style.backgroundClip === "content-box"; + + jQuery.extend( support, { + boxSizingReliable: function() { + computeStyleTests(); + return boxSizingReliableVal; + }, + pixelBoxStyles: function() { + computeStyleTests(); + return pixelBoxStylesVal; + }, + pixelPosition: function() { + computeStyleTests(); + return pixelPositionVal; + }, + reliableMarginLeft: function() { + computeStyleTests(); + return reliableMarginLeftVal; + }, + scrollboxSize: function() { + computeStyleTests(); + return scrollboxSizeVal; + }, + + // Support: IE 9 - 11+, Edge 15 - 18+ + // IE/Edge misreport `getComputedStyle` of table rows with width/height + // set in CSS while `offset*` properties report correct values. + // Behavior in IE 9 is more subtle than in newer versions & it passes + // some versions of this test; make sure not to make it pass there! + reliableTrDimensions: function() { + var table, tr, trChild, trStyle; + if ( reliableTrDimensionsVal == null ) { + table = document.createElement( "table" ); + tr = document.createElement( "tr" ); + trChild = document.createElement( "div" ); + + table.style.cssText = "position:absolute;left:-11111px"; + tr.style.height = "1px"; + trChild.style.height = "9px"; + + documentElement + .appendChild( table ) + .appendChild( tr ) + .appendChild( trChild ); + + trStyle = window.getComputedStyle( tr ); + reliableTrDimensionsVal = parseInt( trStyle.height ) > 3; + + documentElement.removeChild( table ); + } + return reliableTrDimensionsVal; + } + } ); +} )(); + + +function curCSS( elem, name, computed ) { + var width, minWidth, maxWidth, ret, + + // Support: Firefox 51+ + // Retrieving style before computed somehow + // fixes an issue with getting wrong values + // on detached elements + style = elem.style; + + computed = computed || getStyles( elem ); + + // getPropertyValue is needed for: + // .css('filter') (IE 9 only, #12537) + // .css('--customProperty) (#3144) + if ( computed ) { + ret = computed.getPropertyValue( name ) || computed[ name ]; + + if ( ret === "" && !isAttached( elem ) ) { + ret = jQuery.style( elem, name ); + } + + // A tribute to the "awesome hack by Dean Edwards" + // Android Browser returns percentage for some values, + // but width seems to be reliably pixels. + // This is against the CSSOM draft spec: + // https://drafts.csswg.org/cssom/#resolved-values + if ( !support.pixelBoxStyles() && rnumnonpx.test( ret ) && rboxStyle.test( name ) ) { + + // Remember the original values + width = style.width; + minWidth = style.minWidth; + maxWidth = style.maxWidth; + + // Put in the new values to get a computed value out + style.minWidth = style.maxWidth = style.width = ret; + ret = computed.width; + + // Revert the changed values + style.width = width; + style.minWidth = minWidth; + style.maxWidth = maxWidth; + } + } + + return ret !== undefined ? + + // Support: IE <=9 - 11 only + // IE returns zIndex value as an integer. + ret + "" : + ret; +} + + +function addGetHookIf( conditionFn, hookFn ) { + + // Define the hook, we'll check on the first run if it's really needed. + return { + get: function() { + if ( conditionFn() ) { + + // Hook not needed (or it's not possible to use it due + // to missing dependency), remove it. + delete this.get; + return; + } + + // Hook needed; redefine it so that the support test is not executed again. + return ( this.get = hookFn ).apply( this, arguments ); + } + }; +} + + +var cssPrefixes = [ "Webkit", "Moz", "ms" ], + emptyStyle = document.createElement( "div" ).style, + vendorProps = {}; + +// Return a vendor-prefixed property or undefined +function vendorPropName( name ) { + + // Check for vendor prefixed names + var capName = name[ 0 ].toUpperCase() + name.slice( 1 ), + i = cssPrefixes.length; + + while ( i-- ) { + name = cssPrefixes[ i ] + capName; + if ( name in emptyStyle ) { + return name; + } + } +} + +// Return a potentially-mapped jQuery.cssProps or vendor prefixed property +function finalPropName( name ) { + var final = jQuery.cssProps[ name ] || vendorProps[ name ]; + + if ( final ) { + return final; + } + if ( name in emptyStyle ) { + return name; + } + return vendorProps[ name ] = vendorPropName( name ) || name; +} + + +var + + // Swappable if display is none or starts with table + // except "table", "table-cell", or "table-caption" + // See here for display values: https://developer.mozilla.org/en-US/docs/CSS/display + rdisplayswap = /^(none|table(?!-c[ea]).+)/, + rcustomProp = /^--/, + cssShow = { position: "absolute", visibility: "hidden", display: "block" }, + cssNormalTransform = { + letterSpacing: "0", + fontWeight: "400" + }; + +function setPositiveNumber( _elem, value, subtract ) { + + // Any relative (+/-) values have already been + // normalized at this point + var matches = rcssNum.exec( value ); + return matches ? + + // Guard against undefined "subtract", e.g., when used as in cssHooks + Math.max( 0, matches[ 2 ] - ( subtract || 0 ) ) + ( matches[ 3 ] || "px" ) : + value; +} + +function boxModelAdjustment( elem, dimension, box, isBorderBox, styles, computedVal ) { + var i = dimension === "width" ? 1 : 0, + extra = 0, + delta = 0; + + // Adjustment may not be necessary + if ( box === ( isBorderBox ? "border" : "content" ) ) { + return 0; + } + + for ( ; i < 4; i += 2 ) { + + // Both box models exclude margin + if ( box === "margin" ) { + delta += jQuery.css( elem, box + cssExpand[ i ], true, styles ); + } + + // If we get here with a content-box, we're seeking "padding" or "border" or "margin" + if ( !isBorderBox ) { + + // Add padding + delta += jQuery.css( elem, "padding" + cssExpand[ i ], true, styles ); + + // For "border" or "margin", add border + if ( box !== "padding" ) { + delta += jQuery.css( elem, "border" + cssExpand[ i ] + "Width", true, styles ); + + // But still keep track of it otherwise + } else { + extra += jQuery.css( elem, "border" + cssExpand[ i ] + "Width", true, styles ); + } + + // If we get here with a border-box (content + padding + border), we're seeking "content" or + // "padding" or "margin" + } else { + + // For "content", subtract padding + if ( box === "content" ) { + delta -= jQuery.css( elem, "padding" + cssExpand[ i ], true, styles ); + } + + // For "content" or "padding", subtract border + if ( box !== "margin" ) { + delta -= jQuery.css( elem, "border" + cssExpand[ i ] + "Width", true, styles ); + } + } + } + + // Account for positive content-box scroll gutter when requested by providing computedVal + if ( !isBorderBox && computedVal >= 0 ) { + + // offsetWidth/offsetHeight is a rounded sum of content, padding, scroll gutter, and border + // Assuming integer scroll gutter, subtract the rest and round down + delta += Math.max( 0, Math.ceil( + elem[ "offset" + dimension[ 0 ].toUpperCase() + dimension.slice( 1 ) ] - + computedVal - + delta - + extra - + 0.5 + + // If offsetWidth/offsetHeight is unknown, then we can't determine content-box scroll gutter + // Use an explicit zero to avoid NaN (gh-3964) + ) ) || 0; + } + + return delta; +} + +function getWidthOrHeight( elem, dimension, extra ) { + + // Start with computed style + var styles = getStyles( elem ), + + // To avoid forcing a reflow, only fetch boxSizing if we need it (gh-4322). + // Fake content-box until we know it's needed to know the true value. + boxSizingNeeded = !support.boxSizingReliable() || extra, + isBorderBox = boxSizingNeeded && + jQuery.css( elem, "boxSizing", false, styles ) === "border-box", + valueIsBorderBox = isBorderBox, + + val = curCSS( elem, dimension, styles ), + offsetProp = "offset" + dimension[ 0 ].toUpperCase() + dimension.slice( 1 ); + + // Support: Firefox <=54 + // Return a confounding non-pixel value or feign ignorance, as appropriate. + if ( rnumnonpx.test( val ) ) { + if ( !extra ) { + return val; + } + val = "auto"; + } + + + // Support: IE 9 - 11 only + // Use offsetWidth/offsetHeight for when box sizing is unreliable. + // In those cases, the computed value can be trusted to be border-box. + if ( ( !support.boxSizingReliable() && isBorderBox || + + // Support: IE 10 - 11+, Edge 15 - 18+ + // IE/Edge misreport `getComputedStyle` of table rows with width/height + // set in CSS while `offset*` properties report correct values. + // Interestingly, in some cases IE 9 doesn't suffer from this issue. + !support.reliableTrDimensions() && nodeName( elem, "tr" ) || + + // Fall back to offsetWidth/offsetHeight when value is "auto" + // This happens for inline elements with no explicit setting (gh-3571) + val === "auto" || + + // Support: Android <=4.1 - 4.3 only + // Also use offsetWidth/offsetHeight for misreported inline dimensions (gh-3602) + !parseFloat( val ) && jQuery.css( elem, "display", false, styles ) === "inline" ) && + + // Make sure the element is visible & connected + elem.getClientRects().length ) { + + isBorderBox = jQuery.css( elem, "boxSizing", false, styles ) === "border-box"; + + // Where available, offsetWidth/offsetHeight approximate border box dimensions. + // Where not available (e.g., SVG), assume unreliable box-sizing and interpret the + // retrieved value as a content box dimension. + valueIsBorderBox = offsetProp in elem; + if ( valueIsBorderBox ) { + val = elem[ offsetProp ]; + } + } + + // Normalize "" and auto + val = parseFloat( val ) || 0; + + // Adjust for the element's box model + return ( val + + boxModelAdjustment( + elem, + dimension, + extra || ( isBorderBox ? "border" : "content" ), + valueIsBorderBox, + styles, + + // Provide the current computed size to request scroll gutter calculation (gh-3589) + val + ) + ) + "px"; +} + +jQuery.extend( { + + // Add in style property hooks for overriding the default + // behavior of getting and setting a style property + cssHooks: { + opacity: { + get: function( elem, computed ) { + if ( computed ) { + + // We should always get a number back from opacity + var ret = curCSS( elem, "opacity" ); + return ret === "" ? "1" : ret; + } + } + } + }, + + // Don't automatically add "px" to these possibly-unitless properties + cssNumber: { + "animationIterationCount": true, + "columnCount": true, + "fillOpacity": true, + "flexGrow": true, + "flexShrink": true, + "fontWeight": true, + "gridArea": true, + "gridColumn": true, + "gridColumnEnd": true, + "gridColumnStart": true, + "gridRow": true, + "gridRowEnd": true, + "gridRowStart": true, + "lineHeight": true, + "opacity": true, + "order": true, + "orphans": true, + "widows": true, + "zIndex": true, + "zoom": true + }, + + // Add in properties whose names you wish to fix before + // setting or getting the value + cssProps: {}, + + // Get and set the style property on a DOM Node + style: function( elem, name, value, extra ) { + + // Don't set styles on text and comment nodes + if ( !elem || elem.nodeType === 3 || elem.nodeType === 8 || !elem.style ) { + return; + } + + // Make sure that we're working with the right name + var ret, type, hooks, + origName = camelCase( name ), + isCustomProp = rcustomProp.test( name ), + style = elem.style; + + // Make sure that we're working with the right name. We don't + // want to query the value if it is a CSS custom property + // since they are user-defined. + if ( !isCustomProp ) { + name = finalPropName( origName ); + } + + // Gets hook for the prefixed version, then unprefixed version + hooks = jQuery.cssHooks[ name ] || jQuery.cssHooks[ origName ]; + + // Check if we're setting a value + if ( value !== undefined ) { + type = typeof value; + + // Convert "+=" or "-=" to relative numbers (#7345) + if ( type === "string" && ( ret = rcssNum.exec( value ) ) && ret[ 1 ] ) { + value = adjustCSS( elem, name, ret ); + + // Fixes bug #9237 + type = "number"; + } + + // Make sure that null and NaN values aren't set (#7116) + if ( value == null || value !== value ) { + return; + } + + // If a number was passed in, add the unit (except for certain CSS properties) + // The isCustomProp check can be removed in jQuery 4.0 when we only auto-append + // "px" to a few hardcoded values. + if ( type === "number" && !isCustomProp ) { + value += ret && ret[ 3 ] || ( jQuery.cssNumber[ origName ] ? "" : "px" ); + } + + // background-* props affect original clone's values + if ( !support.clearCloneStyle && value === "" && name.indexOf( "background" ) === 0 ) { + style[ name ] = "inherit"; + } + + // If a hook was provided, use that value, otherwise just set the specified value + if ( !hooks || !( "set" in hooks ) || + ( value = hooks.set( elem, value, extra ) ) !== undefined ) { + + if ( isCustomProp ) { + style.setProperty( name, value ); + } else { + style[ name ] = value; + } + } + + } else { + + // If a hook was provided get the non-computed value from there + if ( hooks && "get" in hooks && + ( ret = hooks.get( elem, false, extra ) ) !== undefined ) { + + return ret; + } + + // Otherwise just get the value from the style object + return style[ name ]; + } + }, + + css: function( elem, name, extra, styles ) { + var val, num, hooks, + origName = camelCase( name ), + isCustomProp = rcustomProp.test( name ); + + // Make sure that we're working with the right name. We don't + // want to modify the value if it is a CSS custom property + // since they are user-defined. + if ( !isCustomProp ) { + name = finalPropName( origName ); + } + + // Try prefixed name followed by the unprefixed name + hooks = jQuery.cssHooks[ name ] || jQuery.cssHooks[ origName ]; + + // If a hook was provided get the computed value from there + if ( hooks && "get" in hooks ) { + val = hooks.get( elem, true, extra ); + } + + // Otherwise, if a way to get the computed value exists, use that + if ( val === undefined ) { + val = curCSS( elem, name, styles ); + } + + // Convert "normal" to computed value + if ( val === "normal" && name in cssNormalTransform ) { + val = cssNormalTransform[ name ]; + } + + // Make numeric if forced or a qualifier was provided and val looks numeric + if ( extra === "" || extra ) { + num = parseFloat( val ); + return extra === true || isFinite( num ) ? num || 0 : val; + } + + return val; + } +} ); + +jQuery.each( [ "height", "width" ], function( _i, dimension ) { + jQuery.cssHooks[ dimension ] = { + get: function( elem, computed, extra ) { + if ( computed ) { + + // Certain elements can have dimension info if we invisibly show them + // but it must have a current display style that would benefit + return rdisplayswap.test( jQuery.css( elem, "display" ) ) && + + // Support: Safari 8+ + // Table columns in Safari have non-zero offsetWidth & zero + // getBoundingClientRect().width unless display is changed. + // Support: IE <=11 only + // Running getBoundingClientRect on a disconnected node + // in IE throws an error. + ( !elem.getClientRects().length || !elem.getBoundingClientRect().width ) ? + swap( elem, cssShow, function() { + return getWidthOrHeight( elem, dimension, extra ); + } ) : + getWidthOrHeight( elem, dimension, extra ); + } + }, + + set: function( elem, value, extra ) { + var matches, + styles = getStyles( elem ), + + // Only read styles.position if the test has a chance to fail + // to avoid forcing a reflow. + scrollboxSizeBuggy = !support.scrollboxSize() && + styles.position === "absolute", + + // To avoid forcing a reflow, only fetch boxSizing if we need it (gh-3991) + boxSizingNeeded = scrollboxSizeBuggy || extra, + isBorderBox = boxSizingNeeded && + jQuery.css( elem, "boxSizing", false, styles ) === "border-box", + subtract = extra ? + boxModelAdjustment( + elem, + dimension, + extra, + isBorderBox, + styles + ) : + 0; + + // Account for unreliable border-box dimensions by comparing offset* to computed and + // faking a content-box to get border and padding (gh-3699) + if ( isBorderBox && scrollboxSizeBuggy ) { + subtract -= Math.ceil( + elem[ "offset" + dimension[ 0 ].toUpperCase() + dimension.slice( 1 ) ] - + parseFloat( styles[ dimension ] ) - + boxModelAdjustment( elem, dimension, "border", false, styles ) - + 0.5 + ); + } + + // Convert to pixels if value adjustment is needed + if ( subtract && ( matches = rcssNum.exec( value ) ) && + ( matches[ 3 ] || "px" ) !== "px" ) { + + elem.style[ dimension ] = value; + value = jQuery.css( elem, dimension ); + } + + return setPositiveNumber( elem, value, subtract ); + } + }; +} ); + +jQuery.cssHooks.marginLeft = addGetHookIf( support.reliableMarginLeft, + function( elem, computed ) { + if ( computed ) { + return ( parseFloat( curCSS( elem, "marginLeft" ) ) || + elem.getBoundingClientRect().left - + swap( elem, { marginLeft: 0 }, function() { + return elem.getBoundingClientRect().left; + } ) + ) + "px"; + } + } +); + +// These hooks are used by animate to expand properties +jQuery.each( { + margin: "", + padding: "", + border: "Width" +}, function( prefix, suffix ) { + jQuery.cssHooks[ prefix + suffix ] = { + expand: function( value ) { + var i = 0, + expanded = {}, + + // Assumes a single number if not a string + parts = typeof value === "string" ? value.split( " " ) : [ value ]; + + for ( ; i < 4; i++ ) { + expanded[ prefix + cssExpand[ i ] + suffix ] = + parts[ i ] || parts[ i - 2 ] || parts[ 0 ]; + } + + return expanded; + } + }; + + if ( prefix !== "margin" ) { + jQuery.cssHooks[ prefix + suffix ].set = setPositiveNumber; + } +} ); + +jQuery.fn.extend( { + css: function( name, value ) { + return access( this, function( elem, name, value ) { + var styles, len, + map = {}, + i = 0; + + if ( Array.isArray( name ) ) { + styles = getStyles( elem ); + len = name.length; + + for ( ; i < len; i++ ) { + map[ name[ i ] ] = jQuery.css( elem, name[ i ], false, styles ); + } + + return map; + } + + return value !== undefined ? + jQuery.style( elem, name, value ) : + jQuery.css( elem, name ); + }, name, value, arguments.length > 1 ); + } +} ); + + +function Tween( elem, options, prop, end, easing ) { + return new Tween.prototype.init( elem, options, prop, end, easing ); +} +jQuery.Tween = Tween; + +Tween.prototype = { + constructor: Tween, + init: function( elem, options, prop, end, easing, unit ) { + this.elem = elem; + this.prop = prop; + this.easing = easing || jQuery.easing._default; + this.options = options; + this.start = this.now = this.cur(); + this.end = end; + this.unit = unit || ( jQuery.cssNumber[ prop ] ? "" : "px" ); + }, + cur: function() { + var hooks = Tween.propHooks[ this.prop ]; + + return hooks && hooks.get ? + hooks.get( this ) : + Tween.propHooks._default.get( this ); + }, + run: function( percent ) { + var eased, + hooks = Tween.propHooks[ this.prop ]; + + if ( this.options.duration ) { + this.pos = eased = jQuery.easing[ this.easing ]( + percent, this.options.duration * percent, 0, 1, this.options.duration + ); + } else { + this.pos = eased = percent; + } + this.now = ( this.end - this.start ) * eased + this.start; + + if ( this.options.step ) { + this.options.step.call( this.elem, this.now, this ); + } + + if ( hooks && hooks.set ) { + hooks.set( this ); + } else { + Tween.propHooks._default.set( this ); + } + return this; + } +}; + +Tween.prototype.init.prototype = Tween.prototype; + +Tween.propHooks = { + _default: { + get: function( tween ) { + var result; + + // Use a property on the element directly when it is not a DOM element, + // or when there is no matching style property that exists. + if ( tween.elem.nodeType !== 1 || + tween.elem[ tween.prop ] != null && tween.elem.style[ tween.prop ] == null ) { + return tween.elem[ tween.prop ]; + } + + // Passing an empty string as a 3rd parameter to .css will automatically + // attempt a parseFloat and fallback to a string if the parse fails. + // Simple values such as "10px" are parsed to Float; + // complex values such as "rotate(1rad)" are returned as-is. + result = jQuery.css( tween.elem, tween.prop, "" ); + + // Empty strings, null, undefined and "auto" are converted to 0. + return !result || result === "auto" ? 0 : result; + }, + set: function( tween ) { + + // Use step hook for back compat. + // Use cssHook if its there. + // Use .style if available and use plain properties where available. + if ( jQuery.fx.step[ tween.prop ] ) { + jQuery.fx.step[ tween.prop ]( tween ); + } else if ( tween.elem.nodeType === 1 && ( + jQuery.cssHooks[ tween.prop ] || + tween.elem.style[ finalPropName( tween.prop ) ] != null ) ) { + jQuery.style( tween.elem, tween.prop, tween.now + tween.unit ); + } else { + tween.elem[ tween.prop ] = tween.now; + } + } + } +}; + +// Support: IE <=9 only +// Panic based approach to setting things on disconnected nodes +Tween.propHooks.scrollTop = Tween.propHooks.scrollLeft = { + set: function( tween ) { + if ( tween.elem.nodeType && tween.elem.parentNode ) { + tween.elem[ tween.prop ] = tween.now; + } + } +}; + +jQuery.easing = { + linear: function( p ) { + return p; + }, + swing: function( p ) { + return 0.5 - Math.cos( p * Math.PI ) / 2; + }, + _default: "swing" +}; + +jQuery.fx = Tween.prototype.init; + +// Back compat <1.8 extension point +jQuery.fx.step = {}; + + + + +var + fxNow, inProgress, + rfxtypes = /^(?:toggle|show|hide)$/, + rrun = /queueHooks$/; + +function schedule() { + if ( inProgress ) { + if ( document.hidden === false && window.requestAnimationFrame ) { + window.requestAnimationFrame( schedule ); + } else { + window.setTimeout( schedule, jQuery.fx.interval ); + } + + jQuery.fx.tick(); + } +} + +// Animations created synchronously will run synchronously +function createFxNow() { + window.setTimeout( function() { + fxNow = undefined; + } ); + return ( fxNow = Date.now() ); +} + +// Generate parameters to create a standard animation +function genFx( type, includeWidth ) { + var which, + i = 0, + attrs = { height: type }; + + // If we include width, step value is 1 to do all cssExpand values, + // otherwise step value is 2 to skip over Left and Right + includeWidth = includeWidth ? 1 : 0; + for ( ; i < 4; i += 2 - includeWidth ) { + which = cssExpand[ i ]; + attrs[ "margin" + which ] = attrs[ "padding" + which ] = type; + } + + if ( includeWidth ) { + attrs.opacity = attrs.width = type; + } + + return attrs; +} + +function createTween( value, prop, animation ) { + var tween, + collection = ( Animation.tweeners[ prop ] || [] ).concat( Animation.tweeners[ "*" ] ), + index = 0, + length = collection.length; + for ( ; index < length; index++ ) { + if ( ( tween = collection[ index ].call( animation, prop, value ) ) ) { + + // We're done with this property + return tween; + } + } +} + +function defaultPrefilter( elem, props, opts ) { + var prop, value, toggle, hooks, oldfire, propTween, restoreDisplay, display, + isBox = "width" in props || "height" in props, + anim = this, + orig = {}, + style = elem.style, + hidden = elem.nodeType && isHiddenWithinTree( elem ), + dataShow = dataPriv.get( elem, "fxshow" ); + + // Queue-skipping animations hijack the fx hooks + if ( !opts.queue ) { + hooks = jQuery._queueHooks( elem, "fx" ); + if ( hooks.unqueued == null ) { + hooks.unqueued = 0; + oldfire = hooks.empty.fire; + hooks.empty.fire = function() { + if ( !hooks.unqueued ) { + oldfire(); + } + }; + } + hooks.unqueued++; + + anim.always( function() { + + // Ensure the complete handler is called before this completes + anim.always( function() { + hooks.unqueued--; + if ( !jQuery.queue( elem, "fx" ).length ) { + hooks.empty.fire(); + } + } ); + } ); + } + + // Detect show/hide animations + for ( prop in props ) { + value = props[ prop ]; + if ( rfxtypes.test( value ) ) { + delete props[ prop ]; + toggle = toggle || value === "toggle"; + if ( value === ( hidden ? "hide" : "show" ) ) { + + // Pretend to be hidden if this is a "show" and + // there is still data from a stopped show/hide + if ( value === "show" && dataShow && dataShow[ prop ] !== undefined ) { + hidden = true; + + // Ignore all other no-op show/hide data + } else { + continue; + } + } + orig[ prop ] = dataShow && dataShow[ prop ] || jQuery.style( elem, prop ); + } + } + + // Bail out if this is a no-op like .hide().hide() + propTween = !jQuery.isEmptyObject( props ); + if ( !propTween && jQuery.isEmptyObject( orig ) ) { + return; + } + + // Restrict "overflow" and "display" styles during box animations + if ( isBox && elem.nodeType === 1 ) { + + // Support: IE <=9 - 11, Edge 12 - 15 + // Record all 3 overflow attributes because IE does not infer the shorthand + // from identically-valued overflowX and overflowY and Edge just mirrors + // the overflowX value there. + opts.overflow = [ style.overflow, style.overflowX, style.overflowY ]; + + // Identify a display type, preferring old show/hide data over the CSS cascade + restoreDisplay = dataShow && dataShow.display; + if ( restoreDisplay == null ) { + restoreDisplay = dataPriv.get( elem, "display" ); + } + display = jQuery.css( elem, "display" ); + if ( display === "none" ) { + if ( restoreDisplay ) { + display = restoreDisplay; + } else { + + // Get nonempty value(s) by temporarily forcing visibility + showHide( [ elem ], true ); + restoreDisplay = elem.style.display || restoreDisplay; + display = jQuery.css( elem, "display" ); + showHide( [ elem ] ); + } + } + + // Animate inline elements as inline-block + if ( display === "inline" || display === "inline-block" && restoreDisplay != null ) { + if ( jQuery.css( elem, "float" ) === "none" ) { + + // Restore the original display value at the end of pure show/hide animations + if ( !propTween ) { + anim.done( function() { + style.display = restoreDisplay; + } ); + if ( restoreDisplay == null ) { + display = style.display; + restoreDisplay = display === "none" ? "" : display; + } + } + style.display = "inline-block"; + } + } + } + + if ( opts.overflow ) { + style.overflow = "hidden"; + anim.always( function() { + style.overflow = opts.overflow[ 0 ]; + style.overflowX = opts.overflow[ 1 ]; + style.overflowY = opts.overflow[ 2 ]; + } ); + } + + // Implement show/hide animations + propTween = false; + for ( prop in orig ) { + + // General show/hide setup for this element animation + if ( !propTween ) { + if ( dataShow ) { + if ( "hidden" in dataShow ) { + hidden = dataShow.hidden; + } + } else { + dataShow = dataPriv.access( elem, "fxshow", { display: restoreDisplay } ); + } + + // Store hidden/visible for toggle so `.stop().toggle()` "reverses" + if ( toggle ) { + dataShow.hidden = !hidden; + } + + // Show elements before animating them + if ( hidden ) { + showHide( [ elem ], true ); + } + + /* eslint-disable no-loop-func */ + + anim.done( function() { + + /* eslint-enable no-loop-func */ + + // The final step of a "hide" animation is actually hiding the element + if ( !hidden ) { + showHide( [ elem ] ); + } + dataPriv.remove( elem, "fxshow" ); + for ( prop in orig ) { + jQuery.style( elem, prop, orig[ prop ] ); + } + } ); + } + + // Per-property setup + propTween = createTween( hidden ? dataShow[ prop ] : 0, prop, anim ); + if ( !( prop in dataShow ) ) { + dataShow[ prop ] = propTween.start; + if ( hidden ) { + propTween.end = propTween.start; + propTween.start = 0; + } + } + } +} + +function propFilter( props, specialEasing ) { + var index, name, easing, value, hooks; + + // camelCase, specialEasing and expand cssHook pass + for ( index in props ) { + name = camelCase( index ); + easing = specialEasing[ name ]; + value = props[ index ]; + if ( Array.isArray( value ) ) { + easing = value[ 1 ]; + value = props[ index ] = value[ 0 ]; + } + + if ( index !== name ) { + props[ name ] = value; + delete props[ index ]; + } + + hooks = jQuery.cssHooks[ name ]; + if ( hooks && "expand" in hooks ) { + value = hooks.expand( value ); + delete props[ name ]; + + // Not quite $.extend, this won't overwrite existing keys. + // Reusing 'index' because we have the correct "name" + for ( index in value ) { + if ( !( index in props ) ) { + props[ index ] = value[ index ]; + specialEasing[ index ] = easing; + } + } + } else { + specialEasing[ name ] = easing; + } + } +} + +function Animation( elem, properties, options ) { + var result, + stopped, + index = 0, + length = Animation.prefilters.length, + deferred = jQuery.Deferred().always( function() { + + // Don't match elem in the :animated selector + delete tick.elem; + } ), + tick = function() { + if ( stopped ) { + return false; + } + var currentTime = fxNow || createFxNow(), + remaining = Math.max( 0, animation.startTime + animation.duration - currentTime ), + + // Support: Android 2.3 only + // Archaic crash bug won't allow us to use `1 - ( 0.5 || 0 )` (#12497) + temp = remaining / animation.duration || 0, + percent = 1 - temp, + index = 0, + length = animation.tweens.length; + + for ( ; index < length; index++ ) { + animation.tweens[ index ].run( percent ); + } + + deferred.notifyWith( elem, [ animation, percent, remaining ] ); + + // If there's more to do, yield + if ( percent < 1 && length ) { + return remaining; + } + + // If this was an empty animation, synthesize a final progress notification + if ( !length ) { + deferred.notifyWith( elem, [ animation, 1, 0 ] ); + } + + // Resolve the animation and report its conclusion + deferred.resolveWith( elem, [ animation ] ); + return false; + }, + animation = deferred.promise( { + elem: elem, + props: jQuery.extend( {}, properties ), + opts: jQuery.extend( true, { + specialEasing: {}, + easing: jQuery.easing._default + }, options ), + originalProperties: properties, + originalOptions: options, + startTime: fxNow || createFxNow(), + duration: options.duration, + tweens: [], + createTween: function( prop, end ) { + var tween = jQuery.Tween( elem, animation.opts, prop, end, + animation.opts.specialEasing[ prop ] || animation.opts.easing ); + animation.tweens.push( tween ); + return tween; + }, + stop: function( gotoEnd ) { + var index = 0, + + // If we are going to the end, we want to run all the tweens + // otherwise we skip this part + length = gotoEnd ? animation.tweens.length : 0; + if ( stopped ) { + return this; + } + stopped = true; + for ( ; index < length; index++ ) { + animation.tweens[ index ].run( 1 ); + } + + // Resolve when we played the last frame; otherwise, reject + if ( gotoEnd ) { + deferred.notifyWith( elem, [ animation, 1, 0 ] ); + deferred.resolveWith( elem, [ animation, gotoEnd ] ); + } else { + deferred.rejectWith( elem, [ animation, gotoEnd ] ); + } + return this; + } + } ), + props = animation.props; + + propFilter( props, animation.opts.specialEasing ); + + for ( ; index < length; index++ ) { + result = Animation.prefilters[ index ].call( animation, elem, props, animation.opts ); + if ( result ) { + if ( isFunction( result.stop ) ) { + jQuery._queueHooks( animation.elem, animation.opts.queue ).stop = + result.stop.bind( result ); + } + return result; + } + } + + jQuery.map( props, createTween, animation ); + + if ( isFunction( animation.opts.start ) ) { + animation.opts.start.call( elem, animation ); + } + + // Attach callbacks from options + animation + .progress( animation.opts.progress ) + .done( animation.opts.done, animation.opts.complete ) + .fail( animation.opts.fail ) + .always( animation.opts.always ); + + jQuery.fx.timer( + jQuery.extend( tick, { + elem: elem, + anim: animation, + queue: animation.opts.queue + } ) + ); + + return animation; +} + +jQuery.Animation = jQuery.extend( Animation, { + + tweeners: { + "*": [ function( prop, value ) { + var tween = this.createTween( prop, value ); + adjustCSS( tween.elem, prop, rcssNum.exec( value ), tween ); + return tween; + } ] + }, + + tweener: function( props, callback ) { + if ( isFunction( props ) ) { + callback = props; + props = [ "*" ]; + } else { + props = props.match( rnothtmlwhite ); + } + + var prop, + index = 0, + length = props.length; + + for ( ; index < length; index++ ) { + prop = props[ index ]; + Animation.tweeners[ prop ] = Animation.tweeners[ prop ] || []; + Animation.tweeners[ prop ].unshift( callback ); + } + }, + + prefilters: [ defaultPrefilter ], + + prefilter: function( callback, prepend ) { + if ( prepend ) { + Animation.prefilters.unshift( callback ); + } else { + Animation.prefilters.push( callback ); + } + } +} ); + +jQuery.speed = function( speed, easing, fn ) { + var opt = speed && typeof speed === "object" ? jQuery.extend( {}, speed ) : { + complete: fn || !fn && easing || + isFunction( speed ) && speed, + duration: speed, + easing: fn && easing || easing && !isFunction( easing ) && easing + }; + + // Go to the end state if fx are off + if ( jQuery.fx.off ) { + opt.duration = 0; + + } else { + if ( typeof opt.duration !== "number" ) { + if ( opt.duration in jQuery.fx.speeds ) { + opt.duration = jQuery.fx.speeds[ opt.duration ]; + + } else { + opt.duration = jQuery.fx.speeds._default; + } + } + } + + // Normalize opt.queue - true/undefined/null -> "fx" + if ( opt.queue == null || opt.queue === true ) { + opt.queue = "fx"; + } + + // Queueing + opt.old = opt.complete; + + opt.complete = function() { + if ( isFunction( opt.old ) ) { + opt.old.call( this ); + } + + if ( opt.queue ) { + jQuery.dequeue( this, opt.queue ); + } + }; + + return opt; +}; + +jQuery.fn.extend( { + fadeTo: function( speed, to, easing, callback ) { + + // Show any hidden elements after setting opacity to 0 + return this.filter( isHiddenWithinTree ).css( "opacity", 0 ).show() + + // Animate to the value specified + .end().animate( { opacity: to }, speed, easing, callback ); + }, + animate: function( prop, speed, easing, callback ) { + var empty = jQuery.isEmptyObject( prop ), + optall = jQuery.speed( speed, easing, callback ), + doAnimation = function() { + + // Operate on a copy of prop so per-property easing won't be lost + var anim = Animation( this, jQuery.extend( {}, prop ), optall ); + + // Empty animations, or finishing resolves immediately + if ( empty || dataPriv.get( this, "finish" ) ) { + anim.stop( true ); + } + }; + doAnimation.finish = doAnimation; + + return empty || optall.queue === false ? + this.each( doAnimation ) : + this.queue( optall.queue, doAnimation ); + }, + stop: function( type, clearQueue, gotoEnd ) { + var stopQueue = function( hooks ) { + var stop = hooks.stop; + delete hooks.stop; + stop( gotoEnd ); + }; + + if ( typeof type !== "string" ) { + gotoEnd = clearQueue; + clearQueue = type; + type = undefined; + } + if ( clearQueue ) { + this.queue( type || "fx", [] ); + } + + return this.each( function() { + var dequeue = true, + index = type != null && type + "queueHooks", + timers = jQuery.timers, + data = dataPriv.get( this ); + + if ( index ) { + if ( data[ index ] && data[ index ].stop ) { + stopQueue( data[ index ] ); + } + } else { + for ( index in data ) { + if ( data[ index ] && data[ index ].stop && rrun.test( index ) ) { + stopQueue( data[ index ] ); + } + } + } + + for ( index = timers.length; index--; ) { + if ( timers[ index ].elem === this && + ( type == null || timers[ index ].queue === type ) ) { + + timers[ index ].anim.stop( gotoEnd ); + dequeue = false; + timers.splice( index, 1 ); + } + } + + // Start the next in the queue if the last step wasn't forced. + // Timers currently will call their complete callbacks, which + // will dequeue but only if they were gotoEnd. + if ( dequeue || !gotoEnd ) { + jQuery.dequeue( this, type ); + } + } ); + }, + finish: function( type ) { + if ( type !== false ) { + type = type || "fx"; + } + return this.each( function() { + var index, + data = dataPriv.get( this ), + queue = data[ type + "queue" ], + hooks = data[ type + "queueHooks" ], + timers = jQuery.timers, + length = queue ? queue.length : 0; + + // Enable finishing flag on private data + data.finish = true; + + // Empty the queue first + jQuery.queue( this, type, [] ); + + if ( hooks && hooks.stop ) { + hooks.stop.call( this, true ); + } + + // Look for any active animations, and finish them + for ( index = timers.length; index--; ) { + if ( timers[ index ].elem === this && timers[ index ].queue === type ) { + timers[ index ].anim.stop( true ); + timers.splice( index, 1 ); + } + } + + // Look for any animations in the old queue and finish them + for ( index = 0; index < length; index++ ) { + if ( queue[ index ] && queue[ index ].finish ) { + queue[ index ].finish.call( this ); + } + } + + // Turn off finishing flag + delete data.finish; + } ); + } +} ); + +jQuery.each( [ "toggle", "show", "hide" ], function( _i, name ) { + var cssFn = jQuery.fn[ name ]; + jQuery.fn[ name ] = function( speed, easing, callback ) { + return speed == null || typeof speed === "boolean" ? + cssFn.apply( this, arguments ) : + this.animate( genFx( name, true ), speed, easing, callback ); + }; +} ); + +// Generate shortcuts for custom animations +jQuery.each( { + slideDown: genFx( "show" ), + slideUp: genFx( "hide" ), + slideToggle: genFx( "toggle" ), + fadeIn: { opacity: "show" }, + fadeOut: { opacity: "hide" }, + fadeToggle: { opacity: "toggle" } +}, function( name, props ) { + jQuery.fn[ name ] = function( speed, easing, callback ) { + return this.animate( props, speed, easing, callback ); + }; +} ); + +jQuery.timers = []; +jQuery.fx.tick = function() { + var timer, + i = 0, + timers = jQuery.timers; + + fxNow = Date.now(); + + for ( ; i < timers.length; i++ ) { + timer = timers[ i ]; + + // Run the timer and safely remove it when done (allowing for external removal) + if ( !timer() && timers[ i ] === timer ) { + timers.splice( i--, 1 ); + } + } + + if ( !timers.length ) { + jQuery.fx.stop(); + } + fxNow = undefined; +}; + +jQuery.fx.timer = function( timer ) { + jQuery.timers.push( timer ); + jQuery.fx.start(); +}; + +jQuery.fx.interval = 13; +jQuery.fx.start = function() { + if ( inProgress ) { + return; + } + + inProgress = true; + schedule(); +}; + +jQuery.fx.stop = function() { + inProgress = null; +}; + +jQuery.fx.speeds = { + slow: 600, + fast: 200, + + // Default speed + _default: 400 +}; + + +// Based off of the plugin by Clint Helfers, with permission. +// https://web.archive.org/web/20100324014747/http://blindsignals.com/index.php/2009/07/jquery-delay/ +jQuery.fn.delay = function( time, type ) { + time = jQuery.fx ? jQuery.fx.speeds[ time ] || time : time; + type = type || "fx"; + + return this.queue( type, function( next, hooks ) { + var timeout = window.setTimeout( next, time ); + hooks.stop = function() { + window.clearTimeout( timeout ); + }; + } ); +}; + + +( function() { + var input = document.createElement( "input" ), + select = document.createElement( "select" ), + opt = select.appendChild( document.createElement( "option" ) ); + + input.type = "checkbox"; + + // Support: Android <=4.3 only + // Default value for a checkbox should be "on" + support.checkOn = input.value !== ""; + + // Support: IE <=11 only + // Must access selectedIndex to make default options select + support.optSelected = opt.selected; + + // Support: IE <=11 only + // An input loses its value after becoming a radio + input = document.createElement( "input" ); + input.value = "t"; + input.type = "radio"; + support.radioValue = input.value === "t"; +} )(); + + +var boolHook, + attrHandle = jQuery.expr.attrHandle; + +jQuery.fn.extend( { + attr: function( name, value ) { + return access( this, jQuery.attr, name, value, arguments.length > 1 ); + }, + + removeAttr: function( name ) { + return this.each( function() { + jQuery.removeAttr( this, name ); + } ); + } +} ); + +jQuery.extend( { + attr: function( elem, name, value ) { + var ret, hooks, + nType = elem.nodeType; + + // Don't get/set attributes on text, comment and attribute nodes + if ( nType === 3 || nType === 8 || nType === 2 ) { + return; + } + + // Fallback to prop when attributes are not supported + if ( typeof elem.getAttribute === "undefined" ) { + return jQuery.prop( elem, name, value ); + } + + // Attribute hooks are determined by the lowercase version + // Grab necessary hook if one is defined + if ( nType !== 1 || !jQuery.isXMLDoc( elem ) ) { + hooks = jQuery.attrHooks[ name.toLowerCase() ] || + ( jQuery.expr.match.bool.test( name ) ? boolHook : undefined ); + } + + if ( value !== undefined ) { + if ( value === null ) { + jQuery.removeAttr( elem, name ); + return; + } + + if ( hooks && "set" in hooks && + ( ret = hooks.set( elem, value, name ) ) !== undefined ) { + return ret; + } + + elem.setAttribute( name, value + "" ); + return value; + } + + if ( hooks && "get" in hooks && ( ret = hooks.get( elem, name ) ) !== null ) { + return ret; + } + + ret = jQuery.find.attr( elem, name ); + + // Non-existent attributes return null, we normalize to undefined + return ret == null ? undefined : ret; + }, + + attrHooks: { + type: { + set: function( elem, value ) { + if ( !support.radioValue && value === "radio" && + nodeName( elem, "input" ) ) { + var val = elem.value; + elem.setAttribute( "type", value ); + if ( val ) { + elem.value = val; + } + return value; + } + } + } + }, + + removeAttr: function( elem, value ) { + var name, + i = 0, + + // Attribute names can contain non-HTML whitespace characters + // https://html.spec.whatwg.org/multipage/syntax.html#attributes-2 + attrNames = value && value.match( rnothtmlwhite ); + + if ( attrNames && elem.nodeType === 1 ) { + while ( ( name = attrNames[ i++ ] ) ) { + elem.removeAttribute( name ); + } + } + } +} ); + +// Hooks for boolean attributes +boolHook = { + set: function( elem, value, name ) { + if ( value === false ) { + + // Remove boolean attributes when set to false + jQuery.removeAttr( elem, name ); + } else { + elem.setAttribute( name, name ); + } + return name; + } +}; + +jQuery.each( jQuery.expr.match.bool.source.match( /\w+/g ), function( _i, name ) { + var getter = attrHandle[ name ] || jQuery.find.attr; + + attrHandle[ name ] = function( elem, name, isXML ) { + var ret, handle, + lowercaseName = name.toLowerCase(); + + if ( !isXML ) { + + // Avoid an infinite loop by temporarily removing this function from the getter + handle = attrHandle[ lowercaseName ]; + attrHandle[ lowercaseName ] = ret; + ret = getter( elem, name, isXML ) != null ? + lowercaseName : + null; + attrHandle[ lowercaseName ] = handle; + } + return ret; + }; +} ); + + + + +var rfocusable = /^(?:input|select|textarea|button)$/i, + rclickable = /^(?:a|area)$/i; + +jQuery.fn.extend( { + prop: function( name, value ) { + return access( this, jQuery.prop, name, value, arguments.length > 1 ); + }, + + removeProp: function( name ) { + return this.each( function() { + delete this[ jQuery.propFix[ name ] || name ]; + } ); + } +} ); + +jQuery.extend( { + prop: function( elem, name, value ) { + var ret, hooks, + nType = elem.nodeType; + + // Don't get/set properties on text, comment and attribute nodes + if ( nType === 3 || nType === 8 || nType === 2 ) { + return; + } + + if ( nType !== 1 || !jQuery.isXMLDoc( elem ) ) { + + // Fix name and attach hooks + name = jQuery.propFix[ name ] || name; + hooks = jQuery.propHooks[ name ]; + } + + if ( value !== undefined ) { + if ( hooks && "set" in hooks && + ( ret = hooks.set( elem, value, name ) ) !== undefined ) { + return ret; + } + + return ( elem[ name ] = value ); + } + + if ( hooks && "get" in hooks && ( ret = hooks.get( elem, name ) ) !== null ) { + return ret; + } + + return elem[ name ]; + }, + + propHooks: { + tabIndex: { + get: function( elem ) { + + // Support: IE <=9 - 11 only + // elem.tabIndex doesn't always return the + // correct value when it hasn't been explicitly set + // https://web.archive.org/web/20141116233347/http://fluidproject.org/blog/2008/01/09/getting-setting-and-removing-tabindex-values-with-javascript/ + // Use proper attribute retrieval(#12072) + var tabindex = jQuery.find.attr( elem, "tabindex" ); + + if ( tabindex ) { + return parseInt( tabindex, 10 ); + } + + if ( + rfocusable.test( elem.nodeName ) || + rclickable.test( elem.nodeName ) && + elem.href + ) { + return 0; + } + + return -1; + } + } + }, + + propFix: { + "for": "htmlFor", + "class": "className" + } +} ); + +// Support: IE <=11 only +// Accessing the selectedIndex property +// forces the browser to respect setting selected +// on the option +// The getter ensures a default option is selected +// when in an optgroup +// eslint rule "no-unused-expressions" is disabled for this code +// since it considers such accessions noop +if ( !support.optSelected ) { + jQuery.propHooks.selected = { + get: function( elem ) { + + /* eslint no-unused-expressions: "off" */ + + var parent = elem.parentNode; + if ( parent && parent.parentNode ) { + parent.parentNode.selectedIndex; + } + return null; + }, + set: function( elem ) { + + /* eslint no-unused-expressions: "off" */ + + var parent = elem.parentNode; + if ( parent ) { + parent.selectedIndex; + + if ( parent.parentNode ) { + parent.parentNode.selectedIndex; + } + } + } + }; +} + +jQuery.each( [ + "tabIndex", + "readOnly", + "maxLength", + "cellSpacing", + "cellPadding", + "rowSpan", + "colSpan", + "useMap", + "frameBorder", + "contentEditable" +], function() { + jQuery.propFix[ this.toLowerCase() ] = this; +} ); + + + + + // Strip and collapse whitespace according to HTML spec + // https://infra.spec.whatwg.org/#strip-and-collapse-ascii-whitespace + function stripAndCollapse( value ) { + var tokens = value.match( rnothtmlwhite ) || []; + return tokens.join( " " ); + } + + +function getClass( elem ) { + return elem.getAttribute && elem.getAttribute( "class" ) || ""; +} + +function classesToArray( value ) { + if ( Array.isArray( value ) ) { + return value; + } + if ( typeof value === "string" ) { + return value.match( rnothtmlwhite ) || []; + } + return []; +} + +jQuery.fn.extend( { + addClass: function( value ) { + var classes, elem, cur, curValue, clazz, j, finalValue, + i = 0; + + if ( isFunction( value ) ) { + return this.each( function( j ) { + jQuery( this ).addClass( value.call( this, j, getClass( this ) ) ); + } ); + } + + classes = classesToArray( value ); + + if ( classes.length ) { + while ( ( elem = this[ i++ ] ) ) { + curValue = getClass( elem ); + cur = elem.nodeType === 1 && ( " " + stripAndCollapse( curValue ) + " " ); + + if ( cur ) { + j = 0; + while ( ( clazz = classes[ j++ ] ) ) { + if ( cur.indexOf( " " + clazz + " " ) < 0 ) { + cur += clazz + " "; + } + } + + // Only assign if different to avoid unneeded rendering. + finalValue = stripAndCollapse( cur ); + if ( curValue !== finalValue ) { + elem.setAttribute( "class", finalValue ); + } + } + } + } + + return this; + }, + + removeClass: function( value ) { + var classes, elem, cur, curValue, clazz, j, finalValue, + i = 0; + + if ( isFunction( value ) ) { + return this.each( function( j ) { + jQuery( this ).removeClass( value.call( this, j, getClass( this ) ) ); + } ); + } + + if ( !arguments.length ) { + return this.attr( "class", "" ); + } + + classes = classesToArray( value ); + + if ( classes.length ) { + while ( ( elem = this[ i++ ] ) ) { + curValue = getClass( elem ); + + // This expression is here for better compressibility (see addClass) + cur = elem.nodeType === 1 && ( " " + stripAndCollapse( curValue ) + " " ); + + if ( cur ) { + j = 0; + while ( ( clazz = classes[ j++ ] ) ) { + + // Remove *all* instances + while ( cur.indexOf( " " + clazz + " " ) > -1 ) { + cur = cur.replace( " " + clazz + " ", " " ); + } + } + + // Only assign if different to avoid unneeded rendering. + finalValue = stripAndCollapse( cur ); + if ( curValue !== finalValue ) { + elem.setAttribute( "class", finalValue ); + } + } + } + } + + return this; + }, + + toggleClass: function( value, stateVal ) { + var type = typeof value, + isValidValue = type === "string" || Array.isArray( value ); + + if ( typeof stateVal === "boolean" && isValidValue ) { + return stateVal ? this.addClass( value ) : this.removeClass( value ); + } + + if ( isFunction( value ) ) { + return this.each( function( i ) { + jQuery( this ).toggleClass( + value.call( this, i, getClass( this ), stateVal ), + stateVal + ); + } ); + } + + return this.each( function() { + var className, i, self, classNames; + + if ( isValidValue ) { + + // Toggle individual class names + i = 0; + self = jQuery( this ); + classNames = classesToArray( value ); + + while ( ( className = classNames[ i++ ] ) ) { + + // Check each className given, space separated list + if ( self.hasClass( className ) ) { + self.removeClass( className ); + } else { + self.addClass( className ); + } + } + + // Toggle whole class name + } else if ( value === undefined || type === "boolean" ) { + className = getClass( this ); + if ( className ) { + + // Store className if set + dataPriv.set( this, "__className__", className ); + } + + // If the element has a class name or if we're passed `false`, + // then remove the whole classname (if there was one, the above saved it). + // Otherwise bring back whatever was previously saved (if anything), + // falling back to the empty string if nothing was stored. + if ( this.setAttribute ) { + this.setAttribute( "class", + className || value === false ? + "" : + dataPriv.get( this, "__className__" ) || "" + ); + } + } + } ); + }, + + hasClass: function( selector ) { + var className, elem, + i = 0; + + className = " " + selector + " "; + while ( ( elem = this[ i++ ] ) ) { + if ( elem.nodeType === 1 && + ( " " + stripAndCollapse( getClass( elem ) ) + " " ).indexOf( className ) > -1 ) { + return true; + } + } + + return false; + } +} ); + + + + +var rreturn = /\r/g; + +jQuery.fn.extend( { + val: function( value ) { + var hooks, ret, valueIsFunction, + elem = this[ 0 ]; + + if ( !arguments.length ) { + if ( elem ) { + hooks = jQuery.valHooks[ elem.type ] || + jQuery.valHooks[ elem.nodeName.toLowerCase() ]; + + if ( hooks && + "get" in hooks && + ( ret = hooks.get( elem, "value" ) ) !== undefined + ) { + return ret; + } + + ret = elem.value; + + // Handle most common string cases + if ( typeof ret === "string" ) { + return ret.replace( rreturn, "" ); + } + + // Handle cases where value is null/undef or number + return ret == null ? "" : ret; + } + + return; + } + + valueIsFunction = isFunction( value ); + + return this.each( function( i ) { + var val; + + if ( this.nodeType !== 1 ) { + return; + } + + if ( valueIsFunction ) { + val = value.call( this, i, jQuery( this ).val() ); + } else { + val = value; + } + + // Treat null/undefined as ""; convert numbers to string + if ( val == null ) { + val = ""; + + } else if ( typeof val === "number" ) { + val += ""; + + } else if ( Array.isArray( val ) ) { + val = jQuery.map( val, function( value ) { + return value == null ? "" : value + ""; + } ); + } + + hooks = jQuery.valHooks[ this.type ] || jQuery.valHooks[ this.nodeName.toLowerCase() ]; + + // If set returns undefined, fall back to normal setting + if ( !hooks || !( "set" in hooks ) || hooks.set( this, val, "value" ) === undefined ) { + this.value = val; + } + } ); + } +} ); + +jQuery.extend( { + valHooks: { + option: { + get: function( elem ) { + + var val = jQuery.find.attr( elem, "value" ); + return val != null ? + val : + + // Support: IE <=10 - 11 only + // option.text throws exceptions (#14686, #14858) + // Strip and collapse whitespace + // https://html.spec.whatwg.org/#strip-and-collapse-whitespace + stripAndCollapse( jQuery.text( elem ) ); + } + }, + select: { + get: function( elem ) { + var value, option, i, + options = elem.options, + index = elem.selectedIndex, + one = elem.type === "select-one", + values = one ? null : [], + max = one ? index + 1 : options.length; + + if ( index < 0 ) { + i = max; + + } else { + i = one ? index : 0; + } + + // Loop through all the selected options + for ( ; i < max; i++ ) { + option = options[ i ]; + + // Support: IE <=9 only + // IE8-9 doesn't update selected after form reset (#2551) + if ( ( option.selected || i === index ) && + + // Don't return options that are disabled or in a disabled optgroup + !option.disabled && + ( !option.parentNode.disabled || + !nodeName( option.parentNode, "optgroup" ) ) ) { + + // Get the specific value for the option + value = jQuery( option ).val(); + + // We don't need an array for one selects + if ( one ) { + return value; + } + + // Multi-Selects return an array + values.push( value ); + } + } + + return values; + }, + + set: function( elem, value ) { + var optionSet, option, + options = elem.options, + values = jQuery.makeArray( value ), + i = options.length; + + while ( i-- ) { + option = options[ i ]; + + /* eslint-disable no-cond-assign */ + + if ( option.selected = + jQuery.inArray( jQuery.valHooks.option.get( option ), values ) > -1 + ) { + optionSet = true; + } + + /* eslint-enable no-cond-assign */ + } + + // Force browsers to behave consistently when non-matching value is set + if ( !optionSet ) { + elem.selectedIndex = -1; + } + return values; + } + } + } +} ); + +// Radios and checkboxes getter/setter +jQuery.each( [ "radio", "checkbox" ], function() { + jQuery.valHooks[ this ] = { + set: function( elem, value ) { + if ( Array.isArray( value ) ) { + return ( elem.checked = jQuery.inArray( jQuery( elem ).val(), value ) > -1 ); + } + } + }; + if ( !support.checkOn ) { + jQuery.valHooks[ this ].get = function( elem ) { + return elem.getAttribute( "value" ) === null ? "on" : elem.value; + }; + } +} ); + + + + +// Return jQuery for attributes-only inclusion + + +support.focusin = "onfocusin" in window; + + +var rfocusMorph = /^(?:focusinfocus|focusoutblur)$/, + stopPropagationCallback = function( e ) { + e.stopPropagation(); + }; + +jQuery.extend( jQuery.event, { + + trigger: function( event, data, elem, onlyHandlers ) { + + var i, cur, tmp, bubbleType, ontype, handle, special, lastElement, + eventPath = [ elem || document ], + type = hasOwn.call( event, "type" ) ? event.type : event, + namespaces = hasOwn.call( event, "namespace" ) ? event.namespace.split( "." ) : []; + + cur = lastElement = tmp = elem = elem || document; + + // Don't do events on text and comment nodes + if ( elem.nodeType === 3 || elem.nodeType === 8 ) { + return; + } + + // focus/blur morphs to focusin/out; ensure we're not firing them right now + if ( rfocusMorph.test( type + jQuery.event.triggered ) ) { + return; + } + + if ( type.indexOf( "." ) > -1 ) { + + // Namespaced trigger; create a regexp to match event type in handle() + namespaces = type.split( "." ); + type = namespaces.shift(); + namespaces.sort(); + } + ontype = type.indexOf( ":" ) < 0 && "on" + type; + + // Caller can pass in a jQuery.Event object, Object, or just an event type string + event = event[ jQuery.expando ] ? + event : + new jQuery.Event( type, typeof event === "object" && event ); + + // Trigger bitmask: & 1 for native handlers; & 2 for jQuery (always true) + event.isTrigger = onlyHandlers ? 2 : 3; + event.namespace = namespaces.join( "." ); + event.rnamespace = event.namespace ? + new RegExp( "(^|\\.)" + namespaces.join( "\\.(?:.*\\.|)" ) + "(\\.|$)" ) : + null; + + // Clean up the event in case it is being reused + event.result = undefined; + if ( !event.target ) { + event.target = elem; + } + + // Clone any incoming data and prepend the event, creating the handler arg list + data = data == null ? + [ event ] : + jQuery.makeArray( data, [ event ] ); + + // Allow special events to draw outside the lines + special = jQuery.event.special[ type ] || {}; + if ( !onlyHandlers && special.trigger && special.trigger.apply( elem, data ) === false ) { + return; + } + + // Determine event propagation path in advance, per W3C events spec (#9951) + // Bubble up to document, then to window; watch for a global ownerDocument var (#9724) + if ( !onlyHandlers && !special.noBubble && !isWindow( elem ) ) { + + bubbleType = special.delegateType || type; + if ( !rfocusMorph.test( bubbleType + type ) ) { + cur = cur.parentNode; + } + for ( ; cur; cur = cur.parentNode ) { + eventPath.push( cur ); + tmp = cur; + } + + // Only add window if we got to document (e.g., not plain obj or detached DOM) + if ( tmp === ( elem.ownerDocument || document ) ) { + eventPath.push( tmp.defaultView || tmp.parentWindow || window ); + } + } + + // Fire handlers on the event path + i = 0; + while ( ( cur = eventPath[ i++ ] ) && !event.isPropagationStopped() ) { + lastElement = cur; + event.type = i > 1 ? + bubbleType : + special.bindType || type; + + // jQuery handler + handle = ( + dataPriv.get( cur, "events" ) || Object.create( null ) + )[ event.type ] && + dataPriv.get( cur, "handle" ); + if ( handle ) { + handle.apply( cur, data ); + } + + // Native handler + handle = ontype && cur[ ontype ]; + if ( handle && handle.apply && acceptData( cur ) ) { + event.result = handle.apply( cur, data ); + if ( event.result === false ) { + event.preventDefault(); + } + } + } + event.type = type; + + // If nobody prevented the default action, do it now + if ( !onlyHandlers && !event.isDefaultPrevented() ) { + + if ( ( !special._default || + special._default.apply( eventPath.pop(), data ) === false ) && + acceptData( elem ) ) { + + // Call a native DOM method on the target with the same name as the event. + // Don't do default actions on window, that's where global variables be (#6170) + if ( ontype && isFunction( elem[ type ] ) && !isWindow( elem ) ) { + + // Don't re-trigger an onFOO event when we call its FOO() method + tmp = elem[ ontype ]; + + if ( tmp ) { + elem[ ontype ] = null; + } + + // Prevent re-triggering of the same event, since we already bubbled it above + jQuery.event.triggered = type; + + if ( event.isPropagationStopped() ) { + lastElement.addEventListener( type, stopPropagationCallback ); + } + + elem[ type ](); + + if ( event.isPropagationStopped() ) { + lastElement.removeEventListener( type, stopPropagationCallback ); + } + + jQuery.event.triggered = undefined; + + if ( tmp ) { + elem[ ontype ] = tmp; + } + } + } + } + + return event.result; + }, + + // Piggyback on a donor event to simulate a different one + // Used only for `focus(in | out)` events + simulate: function( type, elem, event ) { + var e = jQuery.extend( + new jQuery.Event(), + event, + { + type: type, + isSimulated: true + } + ); + + jQuery.event.trigger( e, null, elem ); + } + +} ); + +jQuery.fn.extend( { + + trigger: function( type, data ) { + return this.each( function() { + jQuery.event.trigger( type, data, this ); + } ); + }, + triggerHandler: function( type, data ) { + var elem = this[ 0 ]; + if ( elem ) { + return jQuery.event.trigger( type, data, elem, true ); + } + } +} ); + + +// Support: Firefox <=44 +// Firefox doesn't have focus(in | out) events +// Related ticket - https://bugzilla.mozilla.org/show_bug.cgi?id=687787 +// +// Support: Chrome <=48 - 49, Safari <=9.0 - 9.1 +// focus(in | out) events fire after focus & blur events, +// which is spec violation - http://www.w3.org/TR/DOM-Level-3-Events/#events-focusevent-event-order +// Related ticket - https://bugs.chromium.org/p/chromium/issues/detail?id=449857 +if ( !support.focusin ) { + jQuery.each( { focus: "focusin", blur: "focusout" }, function( orig, fix ) { + + // Attach a single capturing handler on the document while someone wants focusin/focusout + var handler = function( event ) { + jQuery.event.simulate( fix, event.target, jQuery.event.fix( event ) ); + }; + + jQuery.event.special[ fix ] = { + setup: function() { + + // Handle: regular nodes (via `this.ownerDocument`), window + // (via `this.document`) & document (via `this`). + var doc = this.ownerDocument || this.document || this, + attaches = dataPriv.access( doc, fix ); + + if ( !attaches ) { + doc.addEventListener( orig, handler, true ); + } + dataPriv.access( doc, fix, ( attaches || 0 ) + 1 ); + }, + teardown: function() { + var doc = this.ownerDocument || this.document || this, + attaches = dataPriv.access( doc, fix ) - 1; + + if ( !attaches ) { + doc.removeEventListener( orig, handler, true ); + dataPriv.remove( doc, fix ); + + } else { + dataPriv.access( doc, fix, attaches ); + } + } + }; + } ); +} +var location = window.location; + +var nonce = { guid: Date.now() }; + +var rquery = ( /\?/ ); + + + +// Cross-browser xml parsing +jQuery.parseXML = function( data ) { + var xml; + if ( !data || typeof data !== "string" ) { + return null; + } + + // Support: IE 9 - 11 only + // IE throws on parseFromString with invalid input. + try { + xml = ( new window.DOMParser() ).parseFromString( data, "text/xml" ); + } catch ( e ) { + xml = undefined; + } + + if ( !xml || xml.getElementsByTagName( "parsererror" ).length ) { + jQuery.error( "Invalid XML: " + data ); + } + return xml; +}; + + +var + rbracket = /\[\]$/, + rCRLF = /\r?\n/g, + rsubmitterTypes = /^(?:submit|button|image|reset|file)$/i, + rsubmittable = /^(?:input|select|textarea|keygen)/i; + +function buildParams( prefix, obj, traditional, add ) { + var name; + + if ( Array.isArray( obj ) ) { + + // Serialize array item. + jQuery.each( obj, function( i, v ) { + if ( traditional || rbracket.test( prefix ) ) { + + // Treat each array item as a scalar. + add( prefix, v ); + + } else { + + // Item is non-scalar (array or object), encode its numeric index. + buildParams( + prefix + "[" + ( typeof v === "object" && v != null ? i : "" ) + "]", + v, + traditional, + add + ); + } + } ); + + } else if ( !traditional && toType( obj ) === "object" ) { + + // Serialize object item. + for ( name in obj ) { + buildParams( prefix + "[" + name + "]", obj[ name ], traditional, add ); + } + + } else { + + // Serialize scalar item. + add( prefix, obj ); + } +} + +// Serialize an array of form elements or a set of +// key/values into a query string +jQuery.param = function( a, traditional ) { + var prefix, + s = [], + add = function( key, valueOrFunction ) { + + // If value is a function, invoke it and use its return value + var value = isFunction( valueOrFunction ) ? + valueOrFunction() : + valueOrFunction; + + s[ s.length ] = encodeURIComponent( key ) + "=" + + encodeURIComponent( value == null ? "" : value ); + }; + + if ( a == null ) { + return ""; + } + + // If an array was passed in, assume that it is an array of form elements. + if ( Array.isArray( a ) || ( a.jquery && !jQuery.isPlainObject( a ) ) ) { + + // Serialize the form elements + jQuery.each( a, function() { + add( this.name, this.value ); + } ); + + } else { + + // If traditional, encode the "old" way (the way 1.3.2 or older + // did it), otherwise encode params recursively. + for ( prefix in a ) { + buildParams( prefix, a[ prefix ], traditional, add ); + } + } + + // Return the resulting serialization + return s.join( "&" ); +}; + +jQuery.fn.extend( { + serialize: function() { + return jQuery.param( this.serializeArray() ); + }, + serializeArray: function() { + return this.map( function() { + + // Can add propHook for "elements" to filter or add form elements + var elements = jQuery.prop( this, "elements" ); + return elements ? jQuery.makeArray( elements ) : this; + } ) + .filter( function() { + var type = this.type; + + // Use .is( ":disabled" ) so that fieldset[disabled] works + return this.name && !jQuery( this ).is( ":disabled" ) && + rsubmittable.test( this.nodeName ) && !rsubmitterTypes.test( type ) && + ( this.checked || !rcheckableType.test( type ) ); + } ) + .map( function( _i, elem ) { + var val = jQuery( this ).val(); + + if ( val == null ) { + return null; + } + + if ( Array.isArray( val ) ) { + return jQuery.map( val, function( val ) { + return { name: elem.name, value: val.replace( rCRLF, "\r\n" ) }; + } ); + } + + return { name: elem.name, value: val.replace( rCRLF, "\r\n" ) }; + } ).get(); + } +} ); + + +var + r20 = /%20/g, + rhash = /#.*$/, + rantiCache = /([?&])_=[^&]*/, + rheaders = /^(.*?):[ \t]*([^\r\n]*)$/mg, + + // #7653, #8125, #8152: local protocol detection + rlocalProtocol = /^(?:about|app|app-storage|.+-extension|file|res|widget):$/, + rnoContent = /^(?:GET|HEAD)$/, + rprotocol = /^\/\//, + + /* Prefilters + * 1) They are useful to introduce custom dataTypes (see ajax/jsonp.js for an example) + * 2) These are called: + * - BEFORE asking for a transport + * - AFTER param serialization (s.data is a string if s.processData is true) + * 3) key is the dataType + * 4) the catchall symbol "*" can be used + * 5) execution will start with transport dataType and THEN continue down to "*" if needed + */ + prefilters = {}, + + /* Transports bindings + * 1) key is the dataType + * 2) the catchall symbol "*" can be used + * 3) selection will start with transport dataType and THEN go to "*" if needed + */ + transports = {}, + + // Avoid comment-prolog char sequence (#10098); must appease lint and evade compression + allTypes = "*/".concat( "*" ), + + // Anchor tag for parsing the document origin + originAnchor = document.createElement( "a" ); + originAnchor.href = location.href; + +// Base "constructor" for jQuery.ajaxPrefilter and jQuery.ajaxTransport +function addToPrefiltersOrTransports( structure ) { + + // dataTypeExpression is optional and defaults to "*" + return function( dataTypeExpression, func ) { + + if ( typeof dataTypeExpression !== "string" ) { + func = dataTypeExpression; + dataTypeExpression = "*"; + } + + var dataType, + i = 0, + dataTypes = dataTypeExpression.toLowerCase().match( rnothtmlwhite ) || []; + + if ( isFunction( func ) ) { + + // For each dataType in the dataTypeExpression + while ( ( dataType = dataTypes[ i++ ] ) ) { + + // Prepend if requested + if ( dataType[ 0 ] === "+" ) { + dataType = dataType.slice( 1 ) || "*"; + ( structure[ dataType ] = structure[ dataType ] || [] ).unshift( func ); + + // Otherwise append + } else { + ( structure[ dataType ] = structure[ dataType ] || [] ).push( func ); + } + } + } + }; +} + +// Base inspection function for prefilters and transports +function inspectPrefiltersOrTransports( structure, options, originalOptions, jqXHR ) { + + var inspected = {}, + seekingTransport = ( structure === transports ); + + function inspect( dataType ) { + var selected; + inspected[ dataType ] = true; + jQuery.each( structure[ dataType ] || [], function( _, prefilterOrFactory ) { + var dataTypeOrTransport = prefilterOrFactory( options, originalOptions, jqXHR ); + if ( typeof dataTypeOrTransport === "string" && + !seekingTransport && !inspected[ dataTypeOrTransport ] ) { + + options.dataTypes.unshift( dataTypeOrTransport ); + inspect( dataTypeOrTransport ); + return false; + } else if ( seekingTransport ) { + return !( selected = dataTypeOrTransport ); + } + } ); + return selected; + } + + return inspect( options.dataTypes[ 0 ] ) || !inspected[ "*" ] && inspect( "*" ); +} + +// A special extend for ajax options +// that takes "flat" options (not to be deep extended) +// Fixes #9887 +function ajaxExtend( target, src ) { + var key, deep, + flatOptions = jQuery.ajaxSettings.flatOptions || {}; + + for ( key in src ) { + if ( src[ key ] !== undefined ) { + ( flatOptions[ key ] ? target : ( deep || ( deep = {} ) ) )[ key ] = src[ key ]; + } + } + if ( deep ) { + jQuery.extend( true, target, deep ); + } + + return target; +} + +/* Handles responses to an ajax request: + * - finds the right dataType (mediates between content-type and expected dataType) + * - returns the corresponding response + */ +function ajaxHandleResponses( s, jqXHR, responses ) { + + var ct, type, finalDataType, firstDataType, + contents = s.contents, + dataTypes = s.dataTypes; + + // Remove auto dataType and get content-type in the process + while ( dataTypes[ 0 ] === "*" ) { + dataTypes.shift(); + if ( ct === undefined ) { + ct = s.mimeType || jqXHR.getResponseHeader( "Content-Type" ); + } + } + + // Check if we're dealing with a known content-type + if ( ct ) { + for ( type in contents ) { + if ( contents[ type ] && contents[ type ].test( ct ) ) { + dataTypes.unshift( type ); + break; + } + } + } + + // Check to see if we have a response for the expected dataType + if ( dataTypes[ 0 ] in responses ) { + finalDataType = dataTypes[ 0 ]; + } else { + + // Try convertible dataTypes + for ( type in responses ) { + if ( !dataTypes[ 0 ] || s.converters[ type + " " + dataTypes[ 0 ] ] ) { + finalDataType = type; + break; + } + if ( !firstDataType ) { + firstDataType = type; + } + } + + // Or just use first one + finalDataType = finalDataType || firstDataType; + } + + // If we found a dataType + // We add the dataType to the list if needed + // and return the corresponding response + if ( finalDataType ) { + if ( finalDataType !== dataTypes[ 0 ] ) { + dataTypes.unshift( finalDataType ); + } + return responses[ finalDataType ]; + } +} + +/* Chain conversions given the request and the original response + * Also sets the responseXXX fields on the jqXHR instance + */ +function ajaxConvert( s, response, jqXHR, isSuccess ) { + var conv2, current, conv, tmp, prev, + converters = {}, + + // Work with a copy of dataTypes in case we need to modify it for conversion + dataTypes = s.dataTypes.slice(); + + // Create converters map with lowercased keys + if ( dataTypes[ 1 ] ) { + for ( conv in s.converters ) { + converters[ conv.toLowerCase() ] = s.converters[ conv ]; + } + } + + current = dataTypes.shift(); + + // Convert to each sequential dataType + while ( current ) { + + if ( s.responseFields[ current ] ) { + jqXHR[ s.responseFields[ current ] ] = response; + } + + // Apply the dataFilter if provided + if ( !prev && isSuccess && s.dataFilter ) { + response = s.dataFilter( response, s.dataType ); + } + + prev = current; + current = dataTypes.shift(); + + if ( current ) { + + // There's only work to do if current dataType is non-auto + if ( current === "*" ) { + + current = prev; + + // Convert response if prev dataType is non-auto and differs from current + } else if ( prev !== "*" && prev !== current ) { + + // Seek a direct converter + conv = converters[ prev + " " + current ] || converters[ "* " + current ]; + + // If none found, seek a pair + if ( !conv ) { + for ( conv2 in converters ) { + + // If conv2 outputs current + tmp = conv2.split( " " ); + if ( tmp[ 1 ] === current ) { + + // If prev can be converted to accepted input + conv = converters[ prev + " " + tmp[ 0 ] ] || + converters[ "* " + tmp[ 0 ] ]; + if ( conv ) { + + // Condense equivalence converters + if ( conv === true ) { + conv = converters[ conv2 ]; + + // Otherwise, insert the intermediate dataType + } else if ( converters[ conv2 ] !== true ) { + current = tmp[ 0 ]; + dataTypes.unshift( tmp[ 1 ] ); + } + break; + } + } + } + } + + // Apply converter (if not an equivalence) + if ( conv !== true ) { + + // Unless errors are allowed to bubble, catch and return them + if ( conv && s.throws ) { + response = conv( response ); + } else { + try { + response = conv( response ); + } catch ( e ) { + return { + state: "parsererror", + error: conv ? e : "No conversion from " + prev + " to " + current + }; + } + } + } + } + } + } + + return { state: "success", data: response }; +} + +jQuery.extend( { + + // Counter for holding the number of active queries + active: 0, + + // Last-Modified header cache for next request + lastModified: {}, + etag: {}, + + ajaxSettings: { + url: location.href, + type: "GET", + isLocal: rlocalProtocol.test( location.protocol ), + global: true, + processData: true, + async: true, + contentType: "application/x-www-form-urlencoded; charset=UTF-8", + + /* + timeout: 0, + data: null, + dataType: null, + username: null, + password: null, + cache: null, + throws: false, + traditional: false, + headers: {}, + */ + + accepts: { + "*": allTypes, + text: "text/plain", + html: "text/html", + xml: "application/xml, text/xml", + json: "application/json, text/javascript" + }, + + contents: { + xml: /\bxml\b/, + html: /\bhtml/, + json: /\bjson\b/ + }, + + responseFields: { + xml: "responseXML", + text: "responseText", + json: "responseJSON" + }, + + // Data converters + // Keys separate source (or catchall "*") and destination types with a single space + converters: { + + // Convert anything to text + "* text": String, + + // Text to html (true = no transformation) + "text html": true, + + // Evaluate text as a json expression + "text json": JSON.parse, + + // Parse text as xml + "text xml": jQuery.parseXML + }, + + // For options that shouldn't be deep extended: + // you can add your own custom options here if + // and when you create one that shouldn't be + // deep extended (see ajaxExtend) + flatOptions: { + url: true, + context: true + } + }, + + // Creates a full fledged settings object into target + // with both ajaxSettings and settings fields. + // If target is omitted, writes into ajaxSettings. + ajaxSetup: function( target, settings ) { + return settings ? + + // Building a settings object + ajaxExtend( ajaxExtend( target, jQuery.ajaxSettings ), settings ) : + + // Extending ajaxSettings + ajaxExtend( jQuery.ajaxSettings, target ); + }, + + ajaxPrefilter: addToPrefiltersOrTransports( prefilters ), + ajaxTransport: addToPrefiltersOrTransports( transports ), + + // Main method + ajax: function( url, options ) { + + // If url is an object, simulate pre-1.5 signature + if ( typeof url === "object" ) { + options = url; + url = undefined; + } + + // Force options to be an object + options = options || {}; + + var transport, + + // URL without anti-cache param + cacheURL, + + // Response headers + responseHeadersString, + responseHeaders, + + // timeout handle + timeoutTimer, + + // Url cleanup var + urlAnchor, + + // Request state (becomes false upon send and true upon completion) + completed, + + // To know if global events are to be dispatched + fireGlobals, + + // Loop variable + i, + + // uncached part of the url + uncached, + + // Create the final options object + s = jQuery.ajaxSetup( {}, options ), + + // Callbacks context + callbackContext = s.context || s, + + // Context for global events is callbackContext if it is a DOM node or jQuery collection + globalEventContext = s.context && + ( callbackContext.nodeType || callbackContext.jquery ) ? + jQuery( callbackContext ) : + jQuery.event, + + // Deferreds + deferred = jQuery.Deferred(), + completeDeferred = jQuery.Callbacks( "once memory" ), + + // Status-dependent callbacks + statusCode = s.statusCode || {}, + + // Headers (they are sent all at once) + requestHeaders = {}, + requestHeadersNames = {}, + + // Default abort message + strAbort = "canceled", + + // Fake xhr + jqXHR = { + readyState: 0, + + // Builds headers hashtable if needed + getResponseHeader: function( key ) { + var match; + if ( completed ) { + if ( !responseHeaders ) { + responseHeaders = {}; + while ( ( match = rheaders.exec( responseHeadersString ) ) ) { + responseHeaders[ match[ 1 ].toLowerCase() + " " ] = + ( responseHeaders[ match[ 1 ].toLowerCase() + " " ] || [] ) + .concat( match[ 2 ] ); + } + } + match = responseHeaders[ key.toLowerCase() + " " ]; + } + return match == null ? null : match.join( ", " ); + }, + + // Raw string + getAllResponseHeaders: function() { + return completed ? responseHeadersString : null; + }, + + // Caches the header + setRequestHeader: function( name, value ) { + if ( completed == null ) { + name = requestHeadersNames[ name.toLowerCase() ] = + requestHeadersNames[ name.toLowerCase() ] || name; + requestHeaders[ name ] = value; + } + return this; + }, + + // Overrides response content-type header + overrideMimeType: function( type ) { + if ( completed == null ) { + s.mimeType = type; + } + return this; + }, + + // Status-dependent callbacks + statusCode: function( map ) { + var code; + if ( map ) { + if ( completed ) { + + // Execute the appropriate callbacks + jqXHR.always( map[ jqXHR.status ] ); + } else { + + // Lazy-add the new callbacks in a way that preserves old ones + for ( code in map ) { + statusCode[ code ] = [ statusCode[ code ], map[ code ] ]; + } + } + } + return this; + }, + + // Cancel the request + abort: function( statusText ) { + var finalText = statusText || strAbort; + if ( transport ) { + transport.abort( finalText ); + } + done( 0, finalText ); + return this; + } + }; + + // Attach deferreds + deferred.promise( jqXHR ); + + // Add protocol if not provided (prefilters might expect it) + // Handle falsy url in the settings object (#10093: consistency with old signature) + // We also use the url parameter if available + s.url = ( ( url || s.url || location.href ) + "" ) + .replace( rprotocol, location.protocol + "//" ); + + // Alias method option to type as per ticket #12004 + s.type = options.method || options.type || s.method || s.type; + + // Extract dataTypes list + s.dataTypes = ( s.dataType || "*" ).toLowerCase().match( rnothtmlwhite ) || [ "" ]; + + // A cross-domain request is in order when the origin doesn't match the current origin. + if ( s.crossDomain == null ) { + urlAnchor = document.createElement( "a" ); + + // Support: IE <=8 - 11, Edge 12 - 15 + // IE throws exception on accessing the href property if url is malformed, + // e.g. http://example.com:80x/ + try { + urlAnchor.href = s.url; + + // Support: IE <=8 - 11 only + // Anchor's host property isn't correctly set when s.url is relative + urlAnchor.href = urlAnchor.href; + s.crossDomain = originAnchor.protocol + "//" + originAnchor.host !== + urlAnchor.protocol + "//" + urlAnchor.host; + } catch ( e ) { + + // If there is an error parsing the URL, assume it is crossDomain, + // it can be rejected by the transport if it is invalid + s.crossDomain = true; + } + } + + // Convert data if not already a string + if ( s.data && s.processData && typeof s.data !== "string" ) { + s.data = jQuery.param( s.data, s.traditional ); + } + + // Apply prefilters + inspectPrefiltersOrTransports( prefilters, s, options, jqXHR ); + + // If request was aborted inside a prefilter, stop there + if ( completed ) { + return jqXHR; + } + + // We can fire global events as of now if asked to + // Don't fire events if jQuery.event is undefined in an AMD-usage scenario (#15118) + fireGlobals = jQuery.event && s.global; + + // Watch for a new set of requests + if ( fireGlobals && jQuery.active++ === 0 ) { + jQuery.event.trigger( "ajaxStart" ); + } + + // Uppercase the type + s.type = s.type.toUpperCase(); + + // Determine if request has content + s.hasContent = !rnoContent.test( s.type ); + + // Save the URL in case we're toying with the If-Modified-Since + // and/or If-None-Match header later on + // Remove hash to simplify url manipulation + cacheURL = s.url.replace( rhash, "" ); + + // More options handling for requests with no content + if ( !s.hasContent ) { + + // Remember the hash so we can put it back + uncached = s.url.slice( cacheURL.length ); + + // If data is available and should be processed, append data to url + if ( s.data && ( s.processData || typeof s.data === "string" ) ) { + cacheURL += ( rquery.test( cacheURL ) ? "&" : "?" ) + s.data; + + // #9682: remove data so that it's not used in an eventual retry + delete s.data; + } + + // Add or update anti-cache param if needed + if ( s.cache === false ) { + cacheURL = cacheURL.replace( rantiCache, "$1" ); + uncached = ( rquery.test( cacheURL ) ? "&" : "?" ) + "_=" + ( nonce.guid++ ) + + uncached; + } + + // Put hash and anti-cache on the URL that will be requested (gh-1732) + s.url = cacheURL + uncached; + + // Change '%20' to '+' if this is encoded form body content (gh-2658) + } else if ( s.data && s.processData && + ( s.contentType || "" ).indexOf( "application/x-www-form-urlencoded" ) === 0 ) { + s.data = s.data.replace( r20, "+" ); + } + + // Set the If-Modified-Since and/or If-None-Match header, if in ifModified mode. + if ( s.ifModified ) { + if ( jQuery.lastModified[ cacheURL ] ) { + jqXHR.setRequestHeader( "If-Modified-Since", jQuery.lastModified[ cacheURL ] ); + } + if ( jQuery.etag[ cacheURL ] ) { + jqXHR.setRequestHeader( "If-None-Match", jQuery.etag[ cacheURL ] ); + } + } + + // Set the correct header, if data is being sent + if ( s.data && s.hasContent && s.contentType !== false || options.contentType ) { + jqXHR.setRequestHeader( "Content-Type", s.contentType ); + } + + // Set the Accepts header for the server, depending on the dataType + jqXHR.setRequestHeader( + "Accept", + s.dataTypes[ 0 ] && s.accepts[ s.dataTypes[ 0 ] ] ? + s.accepts[ s.dataTypes[ 0 ] ] + + ( s.dataTypes[ 0 ] !== "*" ? ", " + allTypes + "; q=0.01" : "" ) : + s.accepts[ "*" ] + ); + + // Check for headers option + for ( i in s.headers ) { + jqXHR.setRequestHeader( i, s.headers[ i ] ); + } + + // Allow custom headers/mimetypes and early abort + if ( s.beforeSend && + ( s.beforeSend.call( callbackContext, jqXHR, s ) === false || completed ) ) { + + // Abort if not done already and return + return jqXHR.abort(); + } + + // Aborting is no longer a cancellation + strAbort = "abort"; + + // Install callbacks on deferreds + completeDeferred.add( s.complete ); + jqXHR.done( s.success ); + jqXHR.fail( s.error ); + + // Get transport + transport = inspectPrefiltersOrTransports( transports, s, options, jqXHR ); + + // If no transport, we auto-abort + if ( !transport ) { + done( -1, "No Transport" ); + } else { + jqXHR.readyState = 1; + + // Send global event + if ( fireGlobals ) { + globalEventContext.trigger( "ajaxSend", [ jqXHR, s ] ); + } + + // If request was aborted inside ajaxSend, stop there + if ( completed ) { + return jqXHR; + } + + // Timeout + if ( s.async && s.timeout > 0 ) { + timeoutTimer = window.setTimeout( function() { + jqXHR.abort( "timeout" ); + }, s.timeout ); + } + + try { + completed = false; + transport.send( requestHeaders, done ); + } catch ( e ) { + + // Rethrow post-completion exceptions + if ( completed ) { + throw e; + } + + // Propagate others as results + done( -1, e ); + } + } + + // Callback for when everything is done + function done( status, nativeStatusText, responses, headers ) { + var isSuccess, success, error, response, modified, + statusText = nativeStatusText; + + // Ignore repeat invocations + if ( completed ) { + return; + } + + completed = true; + + // Clear timeout if it exists + if ( timeoutTimer ) { + window.clearTimeout( timeoutTimer ); + } + + // Dereference transport for early garbage collection + // (no matter how long the jqXHR object will be used) + transport = undefined; + + // Cache response headers + responseHeadersString = headers || ""; + + // Set readyState + jqXHR.readyState = status > 0 ? 4 : 0; + + // Determine if successful + isSuccess = status >= 200 && status < 300 || status === 304; + + // Get response data + if ( responses ) { + response = ajaxHandleResponses( s, jqXHR, responses ); + } + + // Use a noop converter for missing script + if ( !isSuccess && jQuery.inArray( "script", s.dataTypes ) > -1 ) { + s.converters[ "text script" ] = function() {}; + } + + // Convert no matter what (that way responseXXX fields are always set) + response = ajaxConvert( s, response, jqXHR, isSuccess ); + + // If successful, handle type chaining + if ( isSuccess ) { + + // Set the If-Modified-Since and/or If-None-Match header, if in ifModified mode. + if ( s.ifModified ) { + modified = jqXHR.getResponseHeader( "Last-Modified" ); + if ( modified ) { + jQuery.lastModified[ cacheURL ] = modified; + } + modified = jqXHR.getResponseHeader( "etag" ); + if ( modified ) { + jQuery.etag[ cacheURL ] = modified; + } + } + + // if no content + if ( status === 204 || s.type === "HEAD" ) { + statusText = "nocontent"; + + // if not modified + } else if ( status === 304 ) { + statusText = "notmodified"; + + // If we have data, let's convert it + } else { + statusText = response.state; + success = response.data; + error = response.error; + isSuccess = !error; + } + } else { + + // Extract error from statusText and normalize for non-aborts + error = statusText; + if ( status || !statusText ) { + statusText = "error"; + if ( status < 0 ) { + status = 0; + } + } + } + + // Set data for the fake xhr object + jqXHR.status = status; + jqXHR.statusText = ( nativeStatusText || statusText ) + ""; + + // Success/Error + if ( isSuccess ) { + deferred.resolveWith( callbackContext, [ success, statusText, jqXHR ] ); + } else { + deferred.rejectWith( callbackContext, [ jqXHR, statusText, error ] ); + } + + // Status-dependent callbacks + jqXHR.statusCode( statusCode ); + statusCode = undefined; + + if ( fireGlobals ) { + globalEventContext.trigger( isSuccess ? "ajaxSuccess" : "ajaxError", + [ jqXHR, s, isSuccess ? success : error ] ); + } + + // Complete + completeDeferred.fireWith( callbackContext, [ jqXHR, statusText ] ); + + if ( fireGlobals ) { + globalEventContext.trigger( "ajaxComplete", [ jqXHR, s ] ); + + // Handle the global AJAX counter + if ( !( --jQuery.active ) ) { + jQuery.event.trigger( "ajaxStop" ); + } + } + } + + return jqXHR; + }, + + getJSON: function( url, data, callback ) { + return jQuery.get( url, data, callback, "json" ); + }, + + getScript: function( url, callback ) { + return jQuery.get( url, undefined, callback, "script" ); + } +} ); + +jQuery.each( [ "get", "post" ], function( _i, method ) { + jQuery[ method ] = function( url, data, callback, type ) { + + // Shift arguments if data argument was omitted + if ( isFunction( data ) ) { + type = type || callback; + callback = data; + data = undefined; + } + + // The url can be an options object (which then must have .url) + return jQuery.ajax( jQuery.extend( { + url: url, + type: method, + dataType: type, + data: data, + success: callback + }, jQuery.isPlainObject( url ) && url ) ); + }; +} ); + +jQuery.ajaxPrefilter( function( s ) { + var i; + for ( i in s.headers ) { + if ( i.toLowerCase() === "content-type" ) { + s.contentType = s.headers[ i ] || ""; + } + } +} ); + + +jQuery._evalUrl = function( url, options, doc ) { + return jQuery.ajax( { + url: url, + + // Make this explicit, since user can override this through ajaxSetup (#11264) + type: "GET", + dataType: "script", + cache: true, + async: false, + global: false, + + // Only evaluate the response if it is successful (gh-4126) + // dataFilter is not invoked for failure responses, so using it instead + // of the default converter is kludgy but it works. + converters: { + "text script": function() {} + }, + dataFilter: function( response ) { + jQuery.globalEval( response, options, doc ); + } + } ); +}; + + +jQuery.fn.extend( { + wrapAll: function( html ) { + var wrap; + + if ( this[ 0 ] ) { + if ( isFunction( html ) ) { + html = html.call( this[ 0 ] ); + } + + // The elements to wrap the target around + wrap = jQuery( html, this[ 0 ].ownerDocument ).eq( 0 ).clone( true ); + + if ( this[ 0 ].parentNode ) { + wrap.insertBefore( this[ 0 ] ); + } + + wrap.map( function() { + var elem = this; + + while ( elem.firstElementChild ) { + elem = elem.firstElementChild; + } + + return elem; + } ).append( this ); + } + + return this; + }, + + wrapInner: function( html ) { + if ( isFunction( html ) ) { + return this.each( function( i ) { + jQuery( this ).wrapInner( html.call( this, i ) ); + } ); + } + + return this.each( function() { + var self = jQuery( this ), + contents = self.contents(); + + if ( contents.length ) { + contents.wrapAll( html ); + + } else { + self.append( html ); + } + } ); + }, + + wrap: function( html ) { + var htmlIsFunction = isFunction( html ); + + return this.each( function( i ) { + jQuery( this ).wrapAll( htmlIsFunction ? html.call( this, i ) : html ); + } ); + }, + + unwrap: function( selector ) { + this.parent( selector ).not( "body" ).each( function() { + jQuery( this ).replaceWith( this.childNodes ); + } ); + return this; + } +} ); + + +jQuery.expr.pseudos.hidden = function( elem ) { + return !jQuery.expr.pseudos.visible( elem ); +}; +jQuery.expr.pseudos.visible = function( elem ) { + return !!( elem.offsetWidth || elem.offsetHeight || elem.getClientRects().length ); +}; + + + + +jQuery.ajaxSettings.xhr = function() { + try { + return new window.XMLHttpRequest(); + } catch ( e ) {} +}; + +var xhrSuccessStatus = { + + // File protocol always yields status code 0, assume 200 + 0: 200, + + // Support: IE <=9 only + // #1450: sometimes IE returns 1223 when it should be 204 + 1223: 204 + }, + xhrSupported = jQuery.ajaxSettings.xhr(); + +support.cors = !!xhrSupported && ( "withCredentials" in xhrSupported ); +support.ajax = xhrSupported = !!xhrSupported; + +jQuery.ajaxTransport( function( options ) { + var callback, errorCallback; + + // Cross domain only allowed if supported through XMLHttpRequest + if ( support.cors || xhrSupported && !options.crossDomain ) { + return { + send: function( headers, complete ) { + var i, + xhr = options.xhr(); + + xhr.open( + options.type, + options.url, + options.async, + options.username, + options.password + ); + + // Apply custom fields if provided + if ( options.xhrFields ) { + for ( i in options.xhrFields ) { + xhr[ i ] = options.xhrFields[ i ]; + } + } + + // Override mime type if needed + if ( options.mimeType && xhr.overrideMimeType ) { + xhr.overrideMimeType( options.mimeType ); + } + + // X-Requested-With header + // For cross-domain requests, seeing as conditions for a preflight are + // akin to a jigsaw puzzle, we simply never set it to be sure. + // (it can always be set on a per-request basis or even using ajaxSetup) + // For same-domain requests, won't change header if already provided. + if ( !options.crossDomain && !headers[ "X-Requested-With" ] ) { + headers[ "X-Requested-With" ] = "XMLHttpRequest"; + } + + // Set headers + for ( i in headers ) { + xhr.setRequestHeader( i, headers[ i ] ); + } + + // Callback + callback = function( type ) { + return function() { + if ( callback ) { + callback = errorCallback = xhr.onload = + xhr.onerror = xhr.onabort = xhr.ontimeout = + xhr.onreadystatechange = null; + + if ( type === "abort" ) { + xhr.abort(); + } else if ( type === "error" ) { + + // Support: IE <=9 only + // On a manual native abort, IE9 throws + // errors on any property access that is not readyState + if ( typeof xhr.status !== "number" ) { + complete( 0, "error" ); + } else { + complete( + + // File: protocol always yields status 0; see #8605, #14207 + xhr.status, + xhr.statusText + ); + } + } else { + complete( + xhrSuccessStatus[ xhr.status ] || xhr.status, + xhr.statusText, + + // Support: IE <=9 only + // IE9 has no XHR2 but throws on binary (trac-11426) + // For XHR2 non-text, let the caller handle it (gh-2498) + ( xhr.responseType || "text" ) !== "text" || + typeof xhr.responseText !== "string" ? + { binary: xhr.response } : + { text: xhr.responseText }, + xhr.getAllResponseHeaders() + ); + } + } + }; + }; + + // Listen to events + xhr.onload = callback(); + errorCallback = xhr.onerror = xhr.ontimeout = callback( "error" ); + + // Support: IE 9 only + // Use onreadystatechange to replace onabort + // to handle uncaught aborts + if ( xhr.onabort !== undefined ) { + xhr.onabort = errorCallback; + } else { + xhr.onreadystatechange = function() { + + // Check readyState before timeout as it changes + if ( xhr.readyState === 4 ) { + + // Allow onerror to be called first, + // but that will not handle a native abort + // Also, save errorCallback to a variable + // as xhr.onerror cannot be accessed + window.setTimeout( function() { + if ( callback ) { + errorCallback(); + } + } ); + } + }; + } + + // Create the abort callback + callback = callback( "abort" ); + + try { + + // Do send the request (this may raise an exception) + xhr.send( options.hasContent && options.data || null ); + } catch ( e ) { + + // #14683: Only rethrow if this hasn't been notified as an error yet + if ( callback ) { + throw e; + } + } + }, + + abort: function() { + if ( callback ) { + callback(); + } + } + }; + } +} ); + + + + +// Prevent auto-execution of scripts when no explicit dataType was provided (See gh-2432) +jQuery.ajaxPrefilter( function( s ) { + if ( s.crossDomain ) { + s.contents.script = false; + } +} ); + +// Install script dataType +jQuery.ajaxSetup( { + accepts: { + script: "text/javascript, application/javascript, " + + "application/ecmascript, application/x-ecmascript" + }, + contents: { + script: /\b(?:java|ecma)script\b/ + }, + converters: { + "text script": function( text ) { + jQuery.globalEval( text ); + return text; + } + } +} ); + +// Handle cache's special case and crossDomain +jQuery.ajaxPrefilter( "script", function( s ) { + if ( s.cache === undefined ) { + s.cache = false; + } + if ( s.crossDomain ) { + s.type = "GET"; + } +} ); + +// Bind script tag hack transport +jQuery.ajaxTransport( "script", function( s ) { + + // This transport only deals with cross domain or forced-by-attrs requests + if ( s.crossDomain || s.scriptAttrs ) { + var script, callback; + return { + send: function( _, complete ) { + script = jQuery( " + + + + diff --git a/package/appserver/static/js/lib/jquery-ui/jquery-ui.css b/package/appserver/static/js/lib/jquery-ui/jquery-ui.css new file mode 100644 index 0000000000..1b206a5e9e --- /dev/null +++ b/package/appserver/static/js/lib/jquery-ui/jquery-ui.css @@ -0,0 +1,1312 @@ +/*! jQuery UI - v1.12.1 - 2017-08-27 +* http://jqueryui.com +* Includes: draggable.css, core.css, resizable.css, selectable.css, sortable.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, progressbar.css, selectmenu.css, slider.css, spinner.css, tabs.css, tooltip.css, theme.css +* To view and modify this theme, visit http://jqueryui.com/themeroller/?scope=&folderName=base&cornerRadiusShadow=8px&offsetLeftShadow=0px&offsetTopShadow=0px&thicknessShadow=5px&opacityShadow=30&bgImgOpacityShadow=0&bgTextureShadow=flat&bgColorShadow=666666&opacityOverlay=30&bgImgOpacityOverlay=0&bgTextureOverlay=flat&bgColorOverlay=aaaaaa&iconColorError=cc0000&fcError=5f3f3f&borderColorError=f1a899&bgTextureError=flat&bgColorError=fddfdf&iconColorHighlight=777620&fcHighlight=777620&borderColorHighlight=dad55e&bgTextureHighlight=flat&bgColorHighlight=fffa90&iconColorActive=ffffff&fcActive=ffffff&borderColorActive=003eff&bgTextureActive=flat&bgColorActive=007fff&iconColorHover=555555&fcHover=2b2b2b&borderColorHover=cccccc&bgTextureHover=flat&bgColorHover=ededed&iconColorDefault=777777&fcDefault=454545&borderColorDefault=c5c5c5&bgTextureDefault=flat&bgColorDefault=f6f6f6&iconColorContent=444444&fcContent=333333&borderColorContent=dddddd&bgTextureContent=flat&bgColorContent=ffffff&iconColorHeader=444444&fcHeader=333333&borderColorHeader=dddddd&bgTextureHeader=flat&bgColorHeader=e9e9e9&cornerRadius=3px&fwDefault=normal&fsDefault=1em&ffDefault=Arial%2CHelvetica%2Csans-serif +* Copyright jQuery Foundation and other contributors; Licensed MIT */ + +.ui-draggable-handle { + -ms-touch-action: none; + touch-action: none; +} +/* Layout helpers +----------------------------------*/ +.ui-helper-hidden { + display: none; +} +.ui-helper-hidden-accessible { + border: 0; + clip: rect(0 0 0 0); + height: 1px; + margin: -1px; + overflow: hidden; + padding: 0; + position: absolute; + width: 1px; +} +.ui-helper-reset { + margin: 0; + padding: 0; + border: 0; + outline: 0; + line-height: 1.3; + text-decoration: none; + font-size: 100%; + list-style: none; +} +.ui-helper-clearfix:before, +.ui-helper-clearfix:after { + content: ""; + display: table; + border-collapse: collapse; +} +.ui-helper-clearfix:after { + clear: both; +} +.ui-helper-zfix { + width: 100%; + height: 100%; + top: 0; + left: 0; + position: absolute; + opacity: 0; + filter:Alpha(Opacity=0); /* support: IE8 */ +} + +.ui-front { + z-index: 100; +} + + +/* Interaction Cues +----------------------------------*/ +.ui-state-disabled { + cursor: default !important; + pointer-events: none; +} + + +/* Icons +----------------------------------*/ +.ui-icon { + display: inline-block; + vertical-align: middle; + margin-top: -.25em; + position: relative; + text-indent: -99999px; + overflow: hidden; + background-repeat: no-repeat; +} + +.ui-widget-icon-block { + left: 50%; + margin-left: -8px; + display: block; +} + +/* Misc visuals +----------------------------------*/ + +/* Overlays */ +.ui-widget-overlay { + position: fixed; + top: 0; + left: 0; + width: 100%; + height: 100%; +} +.ui-resizable { + position: relative; +} +.ui-resizable-handle { + position: absolute; + font-size: 0.1px; + display: block; + -ms-touch-action: none; + touch-action: none; +} +.ui-resizable-disabled .ui-resizable-handle, +.ui-resizable-autohide .ui-resizable-handle { + display: none; +} +.ui-resizable-n { + cursor: n-resize; + height: 7px; + width: 100%; + top: -5px; + left: 0; +} +.ui-resizable-s { + cursor: s-resize; + height: 7px; + width: 100%; + bottom: -5px; + left: 0; +} +.ui-resizable-e { + cursor: e-resize; + width: 7px; + right: -5px; + top: 0; + height: 100%; +} +.ui-resizable-w { + cursor: w-resize; + width: 7px; + left: -5px; + top: 0; + height: 100%; +} +.ui-resizable-se { + cursor: se-resize; + width: 12px; + height: 12px; + right: 1px; + bottom: 1px; +} +.ui-resizable-sw { + cursor: sw-resize; + width: 9px; + height: 9px; + left: -5px; + bottom: -5px; +} +.ui-resizable-nw { + cursor: nw-resize; + width: 9px; + height: 9px; + left: -5px; + top: -5px; +} +.ui-resizable-ne { + cursor: ne-resize; + width: 9px; + height: 9px; + right: -5px; + top: -5px; +} +.ui-selectable { + -ms-touch-action: none; + touch-action: none; +} +.ui-selectable-helper { + position: absolute; + z-index: 100; + border: 1px dotted black; +} +.ui-sortable-handle { + -ms-touch-action: none; + touch-action: none; +} +.ui-accordion .ui-accordion-header { + display: block; + cursor: pointer; + position: relative; + margin: 2px 0 0 0; + padding: .5em .5em .5em 1.7em; + font-size: 100%; +} +.ui-accordion .ui-accordion-content { + padding: 1em 2.2em; + border-top: 0; + overflow: auto; +} +.ui-autocomplete { + position: absolute; + top: 0; + left: 0; + cursor: default; +} +.ui-menu { + list-style: none; + padding: 0; + margin: 0; + display: block; + outline: 0; +} +.ui-menu .ui-menu { + position: absolute; +} +.ui-menu .ui-menu-item { + margin: 0; + cursor: pointer; + /* support: IE10, see #8844 */ + list-style-image: url("data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7"); +} +.ui-menu .ui-menu-item-wrapper { + position: relative; + padding: 3px 1em 3px .4em; +} +.ui-menu .ui-menu-divider { + margin: 5px 0; + height: 0; + font-size: 0; + line-height: 0; + border-width: 1px 0 0 0; +} +.ui-menu .ui-state-focus, +.ui-menu .ui-state-active { + margin: -1px; +} + +/* icon support */ +.ui-menu-icons { + position: relative; +} +.ui-menu-icons .ui-menu-item-wrapper { + padding-left: 2em; +} + +/* left-aligned */ +.ui-menu .ui-icon { + position: absolute; + top: 0; + bottom: 0; + left: .2em; + margin: auto 0; +} + +/* right-aligned */ +.ui-menu .ui-menu-icon { + left: auto; + right: 0; +} +.ui-button { + padding: .4em 1em; + display: inline-block; + position: relative; + line-height: normal; + margin-right: .1em; + cursor: pointer; + vertical-align: middle; + text-align: center; + -webkit-user-select: none; + -moz-user-select: none; + -ms-user-select: none; + user-select: none; + + /* Support: IE <= 11 */ + overflow: visible; +} + +.ui-button, +.ui-button:link, +.ui-button:visited, +.ui-button:hover, +.ui-button:active { + text-decoration: none; +} + +/* to make room for the icon, a width needs to be set here */ +.ui-button-icon-only { + width: 2em; + box-sizing: border-box; + text-indent: -9999px; + white-space: nowrap; +} + +/* no icon support for input elements */ +input.ui-button.ui-button-icon-only { + text-indent: 0; +} + +/* button icon element(s) */ +.ui-button-icon-only .ui-icon { + position: absolute; + top: 50%; + left: 50%; + margin-top: -8px; + margin-left: -8px; +} + +.ui-button.ui-icon-notext .ui-icon { + padding: 0; + width: 2.1em; + height: 2.1em; + text-indent: -9999px; + white-space: nowrap; + +} + +input.ui-button.ui-icon-notext .ui-icon { + width: auto; + height: auto; + text-indent: 0; + white-space: normal; + padding: .4em 1em; +} + +/* workarounds */ +/* Support: Firefox 5 - 40 */ +input.ui-button::-moz-focus-inner, +button.ui-button::-moz-focus-inner { + border: 0; + padding: 0; +} +.ui-controlgroup { + vertical-align: middle; + display: inline-block; +} +.ui-controlgroup > .ui-controlgroup-item { + float: left; + margin-left: 0; + margin-right: 0; +} +.ui-controlgroup > .ui-controlgroup-item:focus, +.ui-controlgroup > .ui-controlgroup-item.ui-visual-focus { + z-index: 9999; +} +.ui-controlgroup-vertical > .ui-controlgroup-item { + display: block; + float: none; + width: 100%; + margin-top: 0; + margin-bottom: 0; + text-align: left; +} +.ui-controlgroup-vertical .ui-controlgroup-item { + box-sizing: border-box; +} +.ui-controlgroup .ui-controlgroup-label { + padding: .4em 1em; +} +.ui-controlgroup .ui-controlgroup-label span { + font-size: 80%; +} +.ui-controlgroup-horizontal .ui-controlgroup-label + .ui-controlgroup-item { + border-left: none; +} +.ui-controlgroup-vertical .ui-controlgroup-label + .ui-controlgroup-item { + border-top: none; +} +.ui-controlgroup-horizontal .ui-controlgroup-label.ui-widget-content { + border-right: none; +} +.ui-controlgroup-vertical .ui-controlgroup-label.ui-widget-content { + border-bottom: none; +} + +/* Spinner specific style fixes */ +.ui-controlgroup-vertical .ui-spinner-input { + + /* Support: IE8 only, Android < 4.4 only */ + width: 75%; + width: calc( 100% - 2.4em ); +} +.ui-controlgroup-vertical .ui-spinner .ui-spinner-up { + border-top-style: solid; +} + +.ui-checkboxradio-label .ui-icon-background { + box-shadow: inset 1px 1px 1px #ccc; + border-radius: .12em; + border: none; +} +.ui-checkboxradio-radio-label .ui-icon-background { + width: 16px; + height: 16px; + border-radius: 1em; + overflow: visible; + border: none; +} +.ui-checkboxradio-radio-label.ui-checkboxradio-checked .ui-icon, +.ui-checkboxradio-radio-label.ui-checkboxradio-checked:hover .ui-icon { + background-image: none; + width: 8px; + height: 8px; + border-width: 4px; + border-style: solid; +} +.ui-checkboxradio-disabled { + pointer-events: none; +} +.ui-datepicker { + width: 17em; + padding: .2em .2em 0; + display: none; +} +.ui-datepicker .ui-datepicker-header { + position: relative; + padding: .2em 0; +} +.ui-datepicker .ui-datepicker-prev, +.ui-datepicker .ui-datepicker-next { + position: absolute; + top: 2px; + width: 1.8em; + height: 1.8em; +} +.ui-datepicker .ui-datepicker-prev-hover, +.ui-datepicker .ui-datepicker-next-hover { + top: 1px; +} +.ui-datepicker .ui-datepicker-prev { + left: 2px; +} +.ui-datepicker .ui-datepicker-next { + right: 2px; +} +.ui-datepicker .ui-datepicker-prev-hover { + left: 1px; +} +.ui-datepicker .ui-datepicker-next-hover { + right: 1px; +} +.ui-datepicker .ui-datepicker-prev span, +.ui-datepicker .ui-datepicker-next span { + display: block; + position: absolute; + left: 50%; + margin-left: -8px; + top: 50%; + margin-top: -8px; +} +.ui-datepicker .ui-datepicker-title { + margin: 0 2.3em; + line-height: 1.8em; + text-align: center; +} +.ui-datepicker .ui-datepicker-title select { + font-size: 1em; + margin: 1px 0; +} +.ui-datepicker select.ui-datepicker-month, +.ui-datepicker select.ui-datepicker-year { + width: 45%; +} +.ui-datepicker table { + width: 100%; + font-size: .9em; + border-collapse: collapse; + margin: 0 0 .4em; +} +.ui-datepicker th { + padding: .7em .3em; + text-align: center; + font-weight: bold; + border: 0; +} +.ui-datepicker td { + border: 0; + padding: 1px; +} +.ui-datepicker td span, +.ui-datepicker td a { + display: block; + padding: .2em; + text-align: right; + text-decoration: none; +} +.ui-datepicker .ui-datepicker-buttonpane { + background-image: none; + margin: .7em 0 0 0; + padding: 0 .2em; + border-left: 0; + border-right: 0; + border-bottom: 0; +} +.ui-datepicker .ui-datepicker-buttonpane button { + float: right; + margin: .5em .2em .4em; + cursor: pointer; + padding: .2em .6em .3em .6em; + width: auto; + overflow: visible; +} +.ui-datepicker .ui-datepicker-buttonpane button.ui-datepicker-current { + float: left; +} + +/* with multiple calendars */ +.ui-datepicker.ui-datepicker-multi { + width: auto; +} +.ui-datepicker-multi .ui-datepicker-group { + float: left; +} +.ui-datepicker-multi .ui-datepicker-group table { + width: 95%; + margin: 0 auto .4em; +} +.ui-datepicker-multi-2 .ui-datepicker-group { + width: 50%; +} +.ui-datepicker-multi-3 .ui-datepicker-group { + width: 33.3%; +} +.ui-datepicker-multi-4 .ui-datepicker-group { + width: 25%; +} +.ui-datepicker-multi .ui-datepicker-group-last .ui-datepicker-header, +.ui-datepicker-multi .ui-datepicker-group-middle .ui-datepicker-header { + border-left-width: 0; +} +.ui-datepicker-multi .ui-datepicker-buttonpane { + clear: left; +} +.ui-datepicker-row-break { + clear: both; + width: 100%; + font-size: 0; +} + +/* RTL support */ +.ui-datepicker-rtl { + direction: rtl; +} +.ui-datepicker-rtl .ui-datepicker-prev { + right: 2px; + left: auto; +} +.ui-datepicker-rtl .ui-datepicker-next { + left: 2px; + right: auto; +} +.ui-datepicker-rtl .ui-datepicker-prev:hover { + right: 1px; + left: auto; +} +.ui-datepicker-rtl .ui-datepicker-next:hover { + left: 1px; + right: auto; +} +.ui-datepicker-rtl .ui-datepicker-buttonpane { + clear: right; +} +.ui-datepicker-rtl .ui-datepicker-buttonpane button { + float: left; +} +.ui-datepicker-rtl .ui-datepicker-buttonpane button.ui-datepicker-current, +.ui-datepicker-rtl .ui-datepicker-group { + float: right; +} +.ui-datepicker-rtl .ui-datepicker-group-last .ui-datepicker-header, +.ui-datepicker-rtl .ui-datepicker-group-middle .ui-datepicker-header { + border-right-width: 0; + border-left-width: 1px; +} + +/* Icons */ +.ui-datepicker .ui-icon { + display: block; + text-indent: -99999px; + overflow: hidden; + background-repeat: no-repeat; + left: .5em; + top: .3em; +} +.ui-dialog { + position: absolute; + top: 0; + left: 0; + padding: .2em; + outline: 0; +} +.ui-dialog .ui-dialog-titlebar { + padding: .4em 1em; + position: relative; +} +.ui-dialog .ui-dialog-title { + float: left; + margin: .1em 0; + white-space: nowrap; + width: 90%; + overflow: hidden; + text-overflow: ellipsis; +} +.ui-dialog .ui-dialog-titlebar-close { + position: absolute; + right: .3em; + top: 50%; + width: 20px; + margin: -10px 0 0 0; + padding: 1px; + height: 20px; +} +.ui-dialog .ui-dialog-content { + position: relative; + border: 0; + padding: .5em 1em; + background: none; + overflow: auto; +} +.ui-dialog .ui-dialog-buttonpane { + text-align: left; + border-width: 1px 0 0 0; + background-image: none; + margin-top: .5em; + padding: .3em 1em .5em .4em; +} +.ui-dialog .ui-dialog-buttonpane .ui-dialog-buttonset { + float: right; +} +.ui-dialog .ui-dialog-buttonpane button { + margin: .5em .4em .5em 0; + cursor: pointer; +} +.ui-dialog .ui-resizable-n { + height: 2px; + top: 0; +} +.ui-dialog .ui-resizable-e { + width: 2px; + right: 0; +} +.ui-dialog .ui-resizable-s { + height: 2px; + bottom: 0; +} +.ui-dialog .ui-resizable-w { + width: 2px; + left: 0; +} +.ui-dialog .ui-resizable-se, +.ui-dialog .ui-resizable-sw, +.ui-dialog .ui-resizable-ne, +.ui-dialog .ui-resizable-nw { + width: 7px; + height: 7px; +} +.ui-dialog .ui-resizable-se { + right: 0; + bottom: 0; +} +.ui-dialog .ui-resizable-sw { + left: 0; + bottom: 0; +} +.ui-dialog .ui-resizable-ne { + right: 0; + top: 0; +} +.ui-dialog .ui-resizable-nw { + left: 0; + top: 0; +} +.ui-draggable .ui-dialog-titlebar { + cursor: move; +} +.ui-progressbar { + height: 2em; + text-align: left; + overflow: hidden; +} +.ui-progressbar .ui-progressbar-value { + margin: -1px; + height: 100%; +} +.ui-progressbar .ui-progressbar-overlay { + background: url("data:image/gif;base64,R0lGODlhKAAoAIABAAAAAP///yH/C05FVFNDQVBFMi4wAwEAAAAh+QQJAQABACwAAAAAKAAoAAACkYwNqXrdC52DS06a7MFZI+4FHBCKoDeWKXqymPqGqxvJrXZbMx7Ttc+w9XgU2FB3lOyQRWET2IFGiU9m1frDVpxZZc6bfHwv4c1YXP6k1Vdy292Fb6UkuvFtXpvWSzA+HycXJHUXiGYIiMg2R6W459gnWGfHNdjIqDWVqemH2ekpObkpOlppWUqZiqr6edqqWQAAIfkECQEAAQAsAAAAACgAKAAAApSMgZnGfaqcg1E2uuzDmmHUBR8Qil95hiPKqWn3aqtLsS18y7G1SzNeowWBENtQd+T1JktP05nzPTdJZlR6vUxNWWjV+vUWhWNkWFwxl9VpZRedYcflIOLafaa28XdsH/ynlcc1uPVDZxQIR0K25+cICCmoqCe5mGhZOfeYSUh5yJcJyrkZWWpaR8doJ2o4NYq62lAAACH5BAkBAAEALAAAAAAoACgAAAKVDI4Yy22ZnINRNqosw0Bv7i1gyHUkFj7oSaWlu3ovC8GxNso5fluz3qLVhBVeT/Lz7ZTHyxL5dDalQWPVOsQWtRnuwXaFTj9jVVh8pma9JjZ4zYSj5ZOyma7uuolffh+IR5aW97cHuBUXKGKXlKjn+DiHWMcYJah4N0lYCMlJOXipGRr5qdgoSTrqWSq6WFl2ypoaUAAAIfkECQEAAQAsAAAAACgAKAAAApaEb6HLgd/iO7FNWtcFWe+ufODGjRfoiJ2akShbueb0wtI50zm02pbvwfWEMWBQ1zKGlLIhskiEPm9R6vRXxV4ZzWT2yHOGpWMyorblKlNp8HmHEb/lCXjcW7bmtXP8Xt229OVWR1fod2eWqNfHuMjXCPkIGNileOiImVmCOEmoSfn3yXlJWmoHGhqp6ilYuWYpmTqKUgAAIfkECQEAAQAsAAAAACgAKAAAApiEH6kb58biQ3FNWtMFWW3eNVcojuFGfqnZqSebuS06w5V80/X02pKe8zFwP6EFWOT1lDFk8rGERh1TTNOocQ61Hm4Xm2VexUHpzjymViHrFbiELsefVrn6XKfnt2Q9G/+Xdie499XHd2g4h7ioOGhXGJboGAnXSBnoBwKYyfioubZJ2Hn0RuRZaflZOil56Zp6iioKSXpUAAAh+QQJAQABACwAAAAAKAAoAAACkoQRqRvnxuI7kU1a1UU5bd5tnSeOZXhmn5lWK3qNTWvRdQxP8qvaC+/yaYQzXO7BMvaUEmJRd3TsiMAgswmNYrSgZdYrTX6tSHGZO73ezuAw2uxuQ+BbeZfMxsexY35+/Qe4J1inV0g4x3WHuMhIl2jXOKT2Q+VU5fgoSUI52VfZyfkJGkha6jmY+aaYdirq+lQAACH5BAkBAAEALAAAAAAoACgAAAKWBIKpYe0L3YNKToqswUlvznigd4wiR4KhZrKt9Upqip61i9E3vMvxRdHlbEFiEXfk9YARYxOZZD6VQ2pUunBmtRXo1Lf8hMVVcNl8JafV38aM2/Fu5V16Bn63r6xt97j09+MXSFi4BniGFae3hzbH9+hYBzkpuUh5aZmHuanZOZgIuvbGiNeomCnaxxap2upaCZsq+1kAACH5BAkBAAEALAAAAAAoACgAAAKXjI8By5zf4kOxTVrXNVlv1X0d8IGZGKLnNpYtm8Lr9cqVeuOSvfOW79D9aDHizNhDJidFZhNydEahOaDH6nomtJjp1tutKoNWkvA6JqfRVLHU/QUfau9l2x7G54d1fl995xcIGAdXqMfBNadoYrhH+Mg2KBlpVpbluCiXmMnZ2Sh4GBqJ+ckIOqqJ6LmKSllZmsoq6wpQAAAh+QQJAQABACwAAAAAKAAoAAAClYx/oLvoxuJDkU1a1YUZbJ59nSd2ZXhWqbRa2/gF8Gu2DY3iqs7yrq+xBYEkYvFSM8aSSObE+ZgRl1BHFZNr7pRCavZ5BW2142hY3AN/zWtsmf12p9XxxFl2lpLn1rseztfXZjdIWIf2s5dItwjYKBgo9yg5pHgzJXTEeGlZuenpyPmpGQoKOWkYmSpaSnqKileI2FAAACH5BAkBAAEALAAAAAAoACgAAAKVjB+gu+jG4kORTVrVhRlsnn2dJ3ZleFaptFrb+CXmO9OozeL5VfP99HvAWhpiUdcwkpBH3825AwYdU8xTqlLGhtCosArKMpvfa1mMRae9VvWZfeB2XfPkeLmm18lUcBj+p5dnN8jXZ3YIGEhYuOUn45aoCDkp16hl5IjYJvjWKcnoGQpqyPlpOhr3aElaqrq56Bq7VAAAOw=="); + height: 100%; + filter: alpha(opacity=25); /* support: IE8 */ + opacity: 0.25; +} +.ui-progressbar-indeterminate .ui-progressbar-value { + background-image: none; +} +.ui-selectmenu-menu { + padding: 0; + margin: 0; + position: absolute; + top: 0; + left: 0; + display: none; +} +.ui-selectmenu-menu .ui-menu { + overflow: auto; + overflow-x: hidden; + padding-bottom: 1px; +} +.ui-selectmenu-menu .ui-menu .ui-selectmenu-optgroup { + font-size: 1em; + font-weight: bold; + line-height: 1.5; + padding: 2px 0.4em; + margin: 0.5em 0 0 0; + height: auto; + border: 0; +} +.ui-selectmenu-open { + display: block; +} +.ui-selectmenu-text { + display: block; + margin-right: 20px; + overflow: hidden; + text-overflow: ellipsis; +} +.ui-selectmenu-button.ui-button { + text-align: left; + white-space: nowrap; + width: 14em; +} +.ui-selectmenu-icon.ui-icon { + float: right; + margin-top: 0; +} +.ui-slider { + position: relative; + text-align: left; +} +.ui-slider .ui-slider-handle { + position: absolute; + z-index: 2; + width: 1.2em; + height: 1.2em; + cursor: default; + -ms-touch-action: none; + touch-action: none; +} +.ui-slider .ui-slider-range { + position: absolute; + z-index: 1; + font-size: .7em; + display: block; + border: 0; + background-position: 0 0; +} + +/* support: IE8 - See #6727 */ +.ui-slider.ui-state-disabled .ui-slider-handle, +.ui-slider.ui-state-disabled .ui-slider-range { + filter: inherit; +} + +.ui-slider-horizontal { + height: .8em; +} +.ui-slider-horizontal .ui-slider-handle { + top: -.3em; + margin-left: -.6em; +} +.ui-slider-horizontal .ui-slider-range { + top: 0; + height: 100%; +} +.ui-slider-horizontal .ui-slider-range-min { + left: 0; +} +.ui-slider-horizontal .ui-slider-range-max { + right: 0; +} + +.ui-slider-vertical { + width: .8em; + height: 100px; +} +.ui-slider-vertical .ui-slider-handle { + left: -.3em; + margin-left: 0; + margin-bottom: -.6em; +} +.ui-slider-vertical .ui-slider-range { + left: 0; + width: 100%; +} +.ui-slider-vertical .ui-slider-range-min { + bottom: 0; +} +.ui-slider-vertical .ui-slider-range-max { + top: 0; +} +.ui-spinner { + position: relative; + display: inline-block; + overflow: hidden; + padding: 0; + vertical-align: middle; +} +.ui-spinner-input { + border: none; + background: none; + color: inherit; + padding: .222em 0; + margin: .2em 0; + vertical-align: middle; + margin-left: .4em; + margin-right: 2em; +} +.ui-spinner-button { + width: 1.6em; + height: 50%; + font-size: .5em; + padding: 0; + margin: 0; + text-align: center; + position: absolute; + cursor: default; + display: block; + overflow: hidden; + right: 0; +} +/* more specificity required here to override default borders */ +.ui-spinner a.ui-spinner-button { + border-top-style: none; + border-bottom-style: none; + border-right-style: none; +} +.ui-spinner-up { + top: 0; +} +.ui-spinner-down { + bottom: 0; +} +.ui-tabs { + position: relative;/* position: relative prevents IE scroll bug (element with position: relative inside container with overflow: auto appear as "fixed") */ + padding: .2em; +} +.ui-tabs .ui-tabs-nav { + margin: 0; + padding: .2em .2em 0; +} +.ui-tabs .ui-tabs-nav li { + list-style: none; + float: left; + position: relative; + top: 0; + margin: 1px .2em 0 0; + border-bottom-width: 0; + padding: 0; + white-space: nowrap; +} +.ui-tabs .ui-tabs-nav .ui-tabs-anchor { + float: left; + padding: .5em 1em; + text-decoration: none; +} +.ui-tabs .ui-tabs-nav li.ui-tabs-active { + margin-bottom: -1px; + padding-bottom: 1px; +} +.ui-tabs .ui-tabs-nav li.ui-tabs-active .ui-tabs-anchor, +.ui-tabs .ui-tabs-nav li.ui-state-disabled .ui-tabs-anchor, +.ui-tabs .ui-tabs-nav li.ui-tabs-loading .ui-tabs-anchor { + cursor: text; +} +.ui-tabs-collapsible .ui-tabs-nav li.ui-tabs-active .ui-tabs-anchor { + cursor: pointer; +} +.ui-tabs .ui-tabs-panel { + display: block; + border-width: 0; + padding: 1em 1.4em; + background: none; +} +.ui-tooltip { + padding: 8px; + position: absolute; + z-index: 9999; + max-width: 300px; +} +body .ui-tooltip { + border-width: 2px; +} + +/* Component containers +----------------------------------*/ +.ui-widget { + font-family: Arial,Helvetica,sans-serif; + font-size: 1em; +} +.ui-widget .ui-widget { + font-size: 1em; +} +.ui-widget input, +.ui-widget select, +.ui-widget textarea, +.ui-widget button { + font-family: Arial,Helvetica,sans-serif; + font-size: 1em; +} +.ui-widget.ui-widget-content { + border: 1px solid #c5c5c5; +} +.ui-widget-content { + border: 1px solid #dddddd; + background: #ffffff; + color: #333333; +} +.ui-widget-content a { + color: #333333; +} +.ui-widget-header { + border: 1px solid #dddddd; + background: #e9e9e9; + color: #333333; + font-weight: bold; +} +.ui-widget-header a { + color: #333333; +} + +/* Interaction states +----------------------------------*/ +.ui-state-default, +.ui-widget-content .ui-state-default, +.ui-widget-header .ui-state-default, +.ui-button, + +/* We use html here because we need a greater specificity to make sure disabled +works properly when clicked or hovered */ +html .ui-button.ui-state-disabled:hover, +html .ui-button.ui-state-disabled:active { + border: 1px solid #c5c5c5; + background: #f6f6f6; + font-weight: normal; + color: #454545; +} +.ui-state-default a, +.ui-state-default a:link, +.ui-state-default a:visited, +a.ui-button, +a:link.ui-button, +a:visited.ui-button, +.ui-button { + color: #454545; + text-decoration: none; +} +.ui-state-hover, +.ui-widget-content .ui-state-hover, +.ui-widget-header .ui-state-hover, +.ui-state-focus, +.ui-widget-content .ui-state-focus, +.ui-widget-header .ui-state-focus, +.ui-button:hover, +.ui-button:focus { + border: 1px solid #cccccc; + background: #ededed; + font-weight: normal; + color: #2b2b2b; +} +.ui-state-hover a, +.ui-state-hover a:hover, +.ui-state-hover a:link, +.ui-state-hover a:visited, +.ui-state-focus a, +.ui-state-focus a:hover, +.ui-state-focus a:link, +.ui-state-focus a:visited, +a.ui-button:hover, +a.ui-button:focus { + color: #2b2b2b; + text-decoration: none; +} + +.ui-visual-focus { + box-shadow: 0 0 3px 1px rgb(94, 158, 214); +} +.ui-state-active, +.ui-widget-content .ui-state-active, +.ui-widget-header .ui-state-active, +a.ui-button:active, +.ui-button:active, +.ui-button.ui-state-active:hover { + /* border: 1px solid #003eff; + background: #007fff; + font-weight: normal; + color: #ffffff; */ +} +.ui-icon-background, +.ui-state-active .ui-icon-background { + border: #003eff; + background-color: #ffffff; +} +.ui-state-active a, +.ui-state-active a:link, +.ui-state-active a:visited { + color: #ffffff; + text-decoration: none; +} + +/* Interaction Cues +----------------------------------*/ +.ui-state-highlight, +.ui-widget-content .ui-state-highlight, +.ui-widget-header .ui-state-highlight { + border: 1px solid #dad55e; + background: #fffa90; + color: #777620; +} +.ui-state-checked { + border: 1px solid #dad55e; + background: #fffa90; +} +.ui-state-highlight a, +.ui-widget-content .ui-state-highlight a, +.ui-widget-header .ui-state-highlight a { + color: #777620; +} +.ui-state-error, +.ui-widget-content .ui-state-error, +.ui-widget-header .ui-state-error { + border: 1px solid #f1a899; + background: #fddfdf; + color: #5f3f3f; +} +.ui-state-error a, +.ui-widget-content .ui-state-error a, +.ui-widget-header .ui-state-error a { + color: #5f3f3f; +} +.ui-state-error-text, +.ui-widget-content .ui-state-error-text, +.ui-widget-header .ui-state-error-text { + color: #5f3f3f; +} +.ui-priority-primary, +.ui-widget-content .ui-priority-primary, +.ui-widget-header .ui-priority-primary { + font-weight: bold; +} +.ui-priority-secondary, +.ui-widget-content .ui-priority-secondary, +.ui-widget-header .ui-priority-secondary { + opacity: .7; + filter:Alpha(Opacity=70); /* support: IE8 */ + font-weight: normal; +} +.ui-state-disabled, +.ui-widget-content .ui-state-disabled, +.ui-widget-header .ui-state-disabled { + opacity: .35; + filter:Alpha(Opacity=35); /* support: IE8 */ + background-image: none; +} +.ui-state-disabled .ui-icon { + filter:Alpha(Opacity=35); /* support: IE8 - See #6059 */ +} + +/* Icons +----------------------------------*/ + +/* states and images */ +.ui-icon { + width: 16px; + height: 16px; +} +.ui-icon, +.ui-widget-content .ui-icon { + background-image: url("images/ui-icons_444444_256x240.png"); +} +.ui-widget-header .ui-icon { + background-image: url("images/ui-icons_444444_256x240.png"); +} +.ui-state-hover .ui-icon, +.ui-state-focus .ui-icon, +.ui-button:hover .ui-icon, +.ui-button:focus .ui-icon { + background-image: url("images/ui-icons_555555_256x240.png"); +} +.ui-state-active .ui-icon, +.ui-button:active .ui-icon { + background-image: url("images/ui-icons_444444_256x240.png"); +} +.ui-state-highlight .ui-icon, +.ui-button .ui-state-highlight.ui-icon { + background-image: url("images/ui-icons_777620_256x240.png"); +} +.ui-state-error .ui-icon, +.ui-state-error-text .ui-icon { + background-image: url("images/ui-icons_cc0000_256x240.png"); +} +.ui-button .ui-icon { + background-image: url("images/ui-icons_777777_256x240.png"); +} + +/* positioning */ +.ui-icon-blank { background-position: 16px 16px; } +.ui-icon-caret-1-n { background-position: 0 0; } +.ui-icon-caret-1-ne { background-position: -16px 0; } +.ui-icon-caret-1-e { background-position: -32px 0; } +.ui-icon-caret-1-se { background-position: -48px 0; } +.ui-icon-caret-1-s { background-position: -65px 0; } +.ui-icon-caret-1-sw { background-position: -80px 0; } +.ui-icon-caret-1-w { background-position: -96px 0; } +.ui-icon-caret-1-nw { background-position: -112px 0; } +.ui-icon-caret-2-n-s { background-position: -128px 0; } +.ui-icon-caret-2-e-w { background-position: -144px 0; } +.ui-icon-triangle-1-n { background-position: 0 -16px; } +.ui-icon-triangle-1-ne { background-position: -16px -16px; } +.ui-icon-triangle-1-e { background-position: -32px -16px; } +.ui-icon-triangle-1-se { background-position: -48px -16px; } +.ui-icon-triangle-1-s { background-position: -65px -16px; } +.ui-icon-triangle-1-sw { background-position: -80px -16px; } +.ui-icon-triangle-1-w { background-position: -96px -16px; } +.ui-icon-triangle-1-nw { background-position: -112px -16px; } +.ui-icon-triangle-2-n-s { background-position: -128px -16px; } +.ui-icon-triangle-2-e-w { background-position: -144px -16px; } +.ui-icon-arrow-1-n { background-position: 0 -32px; } +.ui-icon-arrow-1-ne { background-position: -16px -32px; } +.ui-icon-arrow-1-e { background-position: -32px -32px; } +.ui-icon-arrow-1-se { background-position: -48px -32px; } +.ui-icon-arrow-1-s { background-position: -65px -32px; } +.ui-icon-arrow-1-sw { background-position: -80px -32px; } +.ui-icon-arrow-1-w { background-position: -96px -32px; } +.ui-icon-arrow-1-nw { background-position: -112px -32px; } +.ui-icon-arrow-2-n-s { background-position: -128px -32px; } +.ui-icon-arrow-2-ne-sw { background-position: -144px -32px; } +.ui-icon-arrow-2-e-w { background-position: -160px -32px; } +.ui-icon-arrow-2-se-nw { background-position: -176px -32px; } +.ui-icon-arrowstop-1-n { background-position: -192px -32px; } +.ui-icon-arrowstop-1-e { background-position: -208px -32px; } +.ui-icon-arrowstop-1-s { background-position: -224px -32px; } +.ui-icon-arrowstop-1-w { background-position: -240px -32px; } +.ui-icon-arrowthick-1-n { background-position: 1px -48px; } +.ui-icon-arrowthick-1-ne { background-position: -16px -48px; } +.ui-icon-arrowthick-1-e { background-position: -32px -48px; } +.ui-icon-arrowthick-1-se { background-position: -48px -48px; } +.ui-icon-arrowthick-1-s { background-position: -64px -48px; } +.ui-icon-arrowthick-1-sw { background-position: -80px -48px; } +.ui-icon-arrowthick-1-w { background-position: -96px -48px; } +.ui-icon-arrowthick-1-nw { background-position: -112px -48px; } +.ui-icon-arrowthick-2-n-s { background-position: -128px -48px; } +.ui-icon-arrowthick-2-ne-sw { background-position: -144px -48px; } +.ui-icon-arrowthick-2-e-w { background-position: -160px -48px; } +.ui-icon-arrowthick-2-se-nw { background-position: -176px -48px; } +.ui-icon-arrowthickstop-1-n { background-position: -192px -48px; } +.ui-icon-arrowthickstop-1-e { background-position: -208px -48px; } +.ui-icon-arrowthickstop-1-s { background-position: -224px -48px; } +.ui-icon-arrowthickstop-1-w { background-position: -240px -48px; } +.ui-icon-arrowreturnthick-1-w { background-position: 0 -64px; } +.ui-icon-arrowreturnthick-1-n { background-position: -16px -64px; } +.ui-icon-arrowreturnthick-1-e { background-position: -32px -64px; } +.ui-icon-arrowreturnthick-1-s { background-position: -48px -64px; } +.ui-icon-arrowreturn-1-w { background-position: -64px -64px; } +.ui-icon-arrowreturn-1-n { background-position: -80px -64px; } +.ui-icon-arrowreturn-1-e { background-position: -96px -64px; } +.ui-icon-arrowreturn-1-s { background-position: -112px -64px; } +.ui-icon-arrowrefresh-1-w { background-position: -128px -64px; } +.ui-icon-arrowrefresh-1-n { background-position: -144px -64px; } +.ui-icon-arrowrefresh-1-e { background-position: -160px -64px; } +.ui-icon-arrowrefresh-1-s { background-position: -176px -64px; } +.ui-icon-arrow-4 { background-position: 0 -80px; } +.ui-icon-arrow-4-diag { background-position: -16px -80px; } +.ui-icon-extlink { background-position: -32px -80px; } +.ui-icon-newwin { background-position: -48px -80px; } +.ui-icon-refresh { background-position: -64px -80px; } +.ui-icon-shuffle { background-position: -80px -80px; } +.ui-icon-transfer-e-w { background-position: -96px -80px; } +.ui-icon-transferthick-e-w { background-position: -112px -80px; } +.ui-icon-folder-collapsed { background-position: 0 -96px; } +.ui-icon-folder-open { background-position: -16px -96px; } +.ui-icon-document { background-position: -32px -96px; } +.ui-icon-document-b { background-position: -48px -96px; } +.ui-icon-note { background-position: -64px -96px; } +.ui-icon-mail-closed { background-position: -80px -96px; } +.ui-icon-mail-open { background-position: -96px -96px; } +.ui-icon-suitcase { background-position: -112px -96px; } +.ui-icon-comment { background-position: -128px -96px; } +.ui-icon-person { background-position: -144px -96px; } +.ui-icon-print { background-position: -160px -96px; } +.ui-icon-trash { background-position: -176px -96px; } +.ui-icon-locked { background-position: -192px -96px; } +.ui-icon-unlocked { background-position: -208px -96px; } +.ui-icon-bookmark { background-position: -224px -96px; } +.ui-icon-tag { background-position: -240px -96px; } +.ui-icon-home { background-position: 0 -112px; } +.ui-icon-flag { background-position: -16px -112px; } +.ui-icon-calendar { background-position: -32px -112px; } +.ui-icon-cart { background-position: -48px -112px; } +.ui-icon-pencil { background-position: -64px -112px; } +.ui-icon-clock { background-position: -80px -112px; } +.ui-icon-disk { background-position: -96px -112px; } +.ui-icon-calculator { background-position: -112px -112px; } +.ui-icon-zoomin { background-position: -128px -112px; } +.ui-icon-zoomout { background-position: -144px -112px; } +.ui-icon-search { background-position: -160px -112px; } +.ui-icon-wrench { background-position: -176px -112px; } +.ui-icon-gear { background-position: -192px -112px; } +.ui-icon-heart { background-position: -208px -112px; } +.ui-icon-star { background-position: -224px -112px; } +.ui-icon-link { background-position: -240px -112px; } +.ui-icon-cancel { background-position: 0 -128px; } +.ui-icon-plus { background-position: -16px -128px; } +.ui-icon-plusthick { background-position: -32px -128px; } +.ui-icon-minus { background-position: -48px -128px; } +.ui-icon-minusthick { background-position: -64px -128px; } +.ui-icon-close { background-position: -80px -128px; } +.ui-icon-closethick { background-position: -96px -128px; } +.ui-icon-key { background-position: -112px -128px; } +.ui-icon-lightbulb { background-position: -128px -128px; } +.ui-icon-scissors { background-position: -144px -128px; } +.ui-icon-clipboard { background-position: -160px -128px; } +.ui-icon-copy { background-position: -176px -128px; } +.ui-icon-contact { background-position: -192px -128px; } +.ui-icon-image { background-position: -208px -128px; } +.ui-icon-video { background-position: -224px -128px; } +.ui-icon-script { background-position: -240px -128px; } +.ui-icon-alert { background-position: 0 -144px; } +.ui-icon-info { background-position: -16px -144px; } +.ui-icon-notice { background-position: -32px -144px; } +.ui-icon-help { background-position: -48px -144px; } +.ui-icon-check { background-position: -64px -144px; } +.ui-icon-bullet { background-position: -80px -144px; } +.ui-icon-radio-on { background-position: -96px -144px; } +.ui-icon-radio-off { background-position: -112px -144px; } +.ui-icon-pin-w { background-position: -128px -144px; } +.ui-icon-pin-s { background-position: -144px -144px; } +.ui-icon-play { background-position: 0 -160px; } +.ui-icon-pause { background-position: -16px -160px; } +.ui-icon-seek-next { background-position: -32px -160px; } +.ui-icon-seek-prev { background-position: -48px -160px; } +.ui-icon-seek-end { background-position: -64px -160px; } +.ui-icon-seek-start { background-position: -80px -160px; } +/* ui-icon-seek-first is deprecated, use ui-icon-seek-start instead */ +.ui-icon-seek-first { background-position: -80px -160px; } +.ui-icon-stop { background-position: -96px -160px; } +.ui-icon-eject { background-position: -112px -160px; } +.ui-icon-volume-off { background-position: -128px -160px; } +.ui-icon-volume-on { background-position: -144px -160px; } +.ui-icon-power { background-position: 0 -176px; } +.ui-icon-signal-diag { background-position: -16px -176px; } +.ui-icon-signal { background-position: -32px -176px; } +.ui-icon-battery-0 { background-position: -48px -176px; } +.ui-icon-battery-1 { background-position: -64px -176px; } +.ui-icon-battery-2 { background-position: -80px -176px; } +.ui-icon-battery-3 { background-position: -96px -176px; } +.ui-icon-circle-plus { background-position: 0 -192px; } +.ui-icon-circle-minus { background-position: -16px -192px; } +.ui-icon-circle-close { background-position: -32px -192px; } +.ui-icon-circle-triangle-e { background-position: -48px -192px; } +.ui-icon-circle-triangle-s { background-position: -64px -192px; } +.ui-icon-circle-triangle-w { background-position: -80px -192px; } +.ui-icon-circle-triangle-n { background-position: -96px -192px; } +.ui-icon-circle-arrow-e { background-position: -112px -192px; } +.ui-icon-circle-arrow-s { background-position: -128px -192px; } +.ui-icon-circle-arrow-w { background-position: -144px -192px; } +.ui-icon-circle-arrow-n { background-position: -160px -192px; } +.ui-icon-circle-zoomin { background-position: -176px -192px; } +.ui-icon-circle-zoomout { background-position: -192px -192px; } +.ui-icon-circle-check { background-position: -208px -192px; } +.ui-icon-circlesmall-plus { background-position: 0 -208px; } +.ui-icon-circlesmall-minus { background-position: -16px -208px; } +.ui-icon-circlesmall-close { background-position: -32px -208px; } +.ui-icon-squaresmall-plus { background-position: -48px -208px; } +.ui-icon-squaresmall-minus { background-position: -64px -208px; } +.ui-icon-squaresmall-close { background-position: -80px -208px; } +.ui-icon-grip-dotted-vertical { background-position: 0 -224px; } +.ui-icon-grip-dotted-horizontal { background-position: -16px -224px; } +.ui-icon-grip-solid-vertical { background-position: -32px -224px; } +.ui-icon-grip-solid-horizontal { background-position: -48px -224px; } +.ui-icon-gripsmall-diagonal-se { background-position: -64px -224px; } +.ui-icon-grip-diagonal-se { background-position: -80px -224px; } + + +/* Misc visuals +----------------------------------*/ + +/* Corner radius */ +.ui-corner-all, +.ui-corner-top, +.ui-corner-left, +.ui-corner-tl { + border-top-left-radius: 3px; +} +.ui-corner-all, +.ui-corner-top, +.ui-corner-right, +.ui-corner-tr { + border-top-right-radius: 3px; +} +.ui-corner-all, +.ui-corner-bottom, +.ui-corner-left, +.ui-corner-bl { + border-bottom-left-radius: 3px; +} +.ui-corner-all, +.ui-corner-bottom, +.ui-corner-right, +.ui-corner-br { + border-bottom-right-radius: 3px; +} + +/* Overlays */ +.ui-widget-overlay { + background: #aaaaaa; + opacity: .3; + filter: Alpha(Opacity=30); /* support: IE8 */ +} +.ui-widget-shadow { + -webkit-box-shadow: 0px 0px 5px #666666; + box-shadow: 0px 0px 5px #666666; +} diff --git a/package/appserver/static/js/lib/jquery-ui/jquery-ui.js b/package/appserver/static/js/lib/jquery-ui/jquery-ui.js new file mode 100644 index 0000000000..fa736e8a04 --- /dev/null +++ b/package/appserver/static/js/lib/jquery-ui/jquery-ui.js @@ -0,0 +1,18706 @@ +/*! jQuery UI - v1.12.1 - 2017-08-27 +* http://jqueryui.com +* Includes: widget.js, position.js, data.js, disable-selection.js, focusable.js, form-reset-mixin.js, jquery-1-7.js, keycode.js, labels.js, scroll-parent.js, tabbable.js, unique-id.js, widgets/draggable.js, widgets/droppable.js, widgets/resizable.js, widgets/selectable.js, widgets/sortable.js, widgets/accordion.js, widgets/autocomplete.js, widgets/button.js, widgets/checkboxradio.js, widgets/controlgroup.js, widgets/datepicker.js, widgets/dialog.js, widgets/menu.js, widgets/mouse.js, widgets/progressbar.js, widgets/selectmenu.js, widgets/slider.js, widgets/spinner.js, widgets/tabs.js, widgets/tooltip.js, effect.js, effects/effect-blind.js, effects/effect-bounce.js, effects/effect-clip.js, effects/effect-drop.js, effects/effect-explode.js, effects/effect-fade.js, effects/effect-fold.js, effects/effect-highlight.js, effects/effect-puff.js, effects/effect-pulsate.js, effects/effect-scale.js, effects/effect-shake.js, effects/effect-size.js, effects/effect-slide.js, effects/effect-transfer.js +* Copyright jQuery Foundation and other contributors; Licensed MIT */ + +(function( factory ) { + if ( typeof define === "function" && define.amd ) { + + // AMD. Register as an anonymous module. + define([ "jquery" ], factory ); + } else { + + // Browser globals + factory( jQuery ); + } +}(function( $ ) { + +$.ui = $.ui || {}; + +var version = $.ui.version = "1.12.1"; + + +/*! + * jQuery UI Widget 1.12.1 + * http://jqueryui.com + * + * Copyright jQuery Foundation and other contributors + * Released under the MIT license. + * http://jquery.org/license + */ + +//>>label: Widget +//>>group: Core +//>>description: Provides a factory for creating stateful widgets with a common API. +//>>docs: http://api.jqueryui.com/jQuery.widget/ +//>>demos: http://jqueryui.com/widget/ + + + +var widgetUuid = 0; +var widgetSlice = Array.prototype.slice; + +$.cleanData = ( function( orig ) { + return function( elems ) { + var events, elem, i; + for ( i = 0; ( elem = elems[ i ] ) != null; i++ ) { + try { + + // Only trigger remove when necessary to save time + events = $._data( elem, "events" ); + if ( events && events.remove ) { + $( elem ).triggerHandler( "remove" ); + } + + // Http://bugs.jquery.com/ticket/8235 + } catch ( e ) {} + } + orig( elems ); + }; +} )( $.cleanData ); + +$.widget = function( name, base, prototype ) { + var existingConstructor, constructor, basePrototype; + + // ProxiedPrototype allows the provided prototype to remain unmodified + // so that it can be used as a mixin for multiple widgets (#8876) + var proxiedPrototype = {}; + + var namespace = name.split( "." )[ 0 ]; + name = name.split( "." )[ 1 ]; + var fullName = namespace + "-" + name; + + if ( !prototype ) { + prototype = base; + base = $.Widget; + } + + if ( $.isArray( prototype ) ) { + prototype = $.extend.apply( null, [ {} ].concat( prototype ) ); + } + + // Create selector for plugin + $.expr[ ":" ][ fullName.toLowerCase() ] = function( elem ) { + return !!$.data( elem, fullName ); + }; + + $[ namespace ] = $[ namespace ] || {}; + existingConstructor = $[ namespace ][ name ]; + constructor = $[ namespace ][ name ] = function( options, element ) { + + // Allow instantiation without "new" keyword + if ( !this._createWidget ) { + return new constructor( options, element ); + } + + // Allow instantiation without initializing for simple inheritance + // must use "new" keyword (the code above always passes args) + if ( arguments.length ) { + this._createWidget( options, element ); + } + }; + + // Extend with the existing constructor to carry over any static properties + $.extend( constructor, existingConstructor, { + version: prototype.version, + + // Copy the object used to create the prototype in case we need to + // redefine the widget later + _proto: $.extend( {}, prototype ), + + // Track widgets that inherit from this widget in case this widget is + // redefined after a widget inherits from it + _childConstructors: [] + } ); + + basePrototype = new base(); + + // We need to make the options hash a property directly on the new instance + // otherwise we'll modify the options hash on the prototype that we're + // inheriting from + basePrototype.options = $.widget.extend( {}, basePrototype.options ); + $.each( prototype, function( prop, value ) { + if ( !$.isFunction( value ) ) { + proxiedPrototype[ prop ] = value; + return; + } + proxiedPrototype[ prop ] = ( function() { + function _super() { + return base.prototype[ prop ].apply( this, arguments ); + } + + function _superApply( args ) { + return base.prototype[ prop ].apply( this, args ); + } + + return function() { + var __super = this._super; + var __superApply = this._superApply; + var returnValue; + + this._super = _super; + this._superApply = _superApply; + + returnValue = value.apply( this, arguments ); + + this._super = __super; + this._superApply = __superApply; + + return returnValue; + }; + } )(); + } ); + constructor.prototype = $.widget.extend( basePrototype, { + + // TODO: remove support for widgetEventPrefix + // always use the name + a colon as the prefix, e.g., draggable:start + // don't prefix for widgets that aren't DOM-based + widgetEventPrefix: existingConstructor ? ( basePrototype.widgetEventPrefix || name ) : name + }, proxiedPrototype, { + constructor: constructor, + namespace: namespace, + widgetName: name, + widgetFullName: fullName + } ); + + // If this widget is being redefined then we need to find all widgets that + // are inheriting from it and redefine all of them so that they inherit from + // the new version of this widget. We're essentially trying to replace one + // level in the prototype chain. + if ( existingConstructor ) { + $.each( existingConstructor._childConstructors, function( i, child ) { + var childPrototype = child.prototype; + + // Redefine the child widget using the same prototype that was + // originally used, but inherit from the new version of the base + $.widget( childPrototype.namespace + "." + childPrototype.widgetName, constructor, + child._proto ); + } ); + + // Remove the list of existing child constructors from the old constructor + // so the old child constructors can be garbage collected + delete existingConstructor._childConstructors; + } else { + base._childConstructors.push( constructor ); + } + + $.widget.bridge( name, constructor ); + + return constructor; +}; + +$.widget.extend = function( target ) { + var input = widgetSlice.call( arguments, 1 ); + var inputIndex = 0; + var inputLength = input.length; + var key; + var value; + + for ( ; inputIndex < inputLength; inputIndex++ ) { + for ( key in input[ inputIndex ] ) { + value = input[ inputIndex ][ key ]; + if ( input[ inputIndex ].hasOwnProperty( key ) && value !== undefined ) { + + // Clone objects + if ( $.isPlainObject( value ) ) { + target[ key ] = $.isPlainObject( target[ key ] ) ? + $.widget.extend( {}, target[ key ], value ) : + + // Don't extend strings, arrays, etc. with objects + $.widget.extend( {}, value ); + + // Copy everything else by reference + } else { + target[ key ] = value; + } + } + } + } + return target; +}; + +$.widget.bridge = function( name, object ) { + var fullName = object.prototype.widgetFullName || name; + $.fn[ name ] = function( options ) { + var isMethodCall = typeof options === "string"; + var args = widgetSlice.call( arguments, 1 ); + var returnValue = this; + + if ( isMethodCall ) { + + // If this is an empty collection, we need to have the instance method + // return undefined instead of the jQuery instance + if ( !this.length && options === "instance" ) { + returnValue = undefined; + } else { + this.each( function() { + var methodValue; + var instance = $.data( this, fullName ); + + if ( options === "instance" ) { + returnValue = instance; + return false; + } + + if ( !instance ) { + return $.error( "cannot call methods on " + name + + " prior to initialization; " + + "attempted to call method '" + options + "'" ); + } + + if ( !$.isFunction( instance[ options ] ) || options.charAt( 0 ) === "_" ) { + return $.error( "no such method '" + options + "' for " + name + + " widget instance" ); + } + + methodValue = instance[ options ].apply( instance, args ); + + if ( methodValue !== instance && methodValue !== undefined ) { + returnValue = methodValue && methodValue.jquery ? + returnValue.pushStack( methodValue.get() ) : + methodValue; + return false; + } + } ); + } + } else { + + // Allow multiple hashes to be passed on init + if ( args.length ) { + options = $.widget.extend.apply( null, [ options ].concat( args ) ); + } + + this.each( function() { + var instance = $.data( this, fullName ); + if ( instance ) { + instance.option( options || {} ); + if ( instance._init ) { + instance._init(); + } + } else { + $.data( this, fullName, new object( options, this ) ); + } + } ); + } + + return returnValue; + }; +}; + +$.Widget = function( /* options, element */ ) {}; +$.Widget._childConstructors = []; + +$.Widget.prototype = { + widgetName: "widget", + widgetEventPrefix: "", + defaultElement: "
", + + options: { + classes: {}, + disabled: false, + + // Callbacks + create: null + }, + + _createWidget: function( options, element ) { + element = $( element || this.defaultElement || this )[ 0 ]; + this.element = $( element ); + this.uuid = widgetUuid++; + this.eventNamespace = "." + this.widgetName + this.uuid; + + this.bindings = $(); + this.hoverable = $(); + this.focusable = $(); + this.classesElementLookup = {}; + + if ( element !== this ) { + $.data( element, this.widgetFullName, this ); + this._on( true, this.element, { + remove: function( event ) { + if ( event.target === element ) { + this.destroy(); + } + } + } ); + this.document = $( element.style ? + + // Element within the document + element.ownerDocument : + + // Element is window or document + element.document || element ); + this.window = $( this.document[ 0 ].defaultView || this.document[ 0 ].parentWindow ); + } + + this.options = $.widget.extend( {}, + this.options, + this._getCreateOptions(), + options ); + + this._create(); + + if ( this.options.disabled ) { + this._setOptionDisabled( this.options.disabled ); + } + + this._trigger( "create", null, this._getCreateEventData() ); + this._init(); + }, + + _getCreateOptions: function() { + return {}; + }, + + _getCreateEventData: $.noop, + + _create: $.noop, + + _init: $.noop, + + destroy: function() { + var that = this; + + this._destroy(); + $.each( this.classesElementLookup, function( key, value ) { + that._removeClass( value, key ); + } ); + + // We can probably remove the unbind calls in 2.0 + // all event bindings should go through this._on() + this.element + .off( this.eventNamespace ) + .removeData( this.widgetFullName ); + this.widget() + .off( this.eventNamespace ) + .removeAttr( "aria-disabled" ); + + // Clean up events and states + this.bindings.off( this.eventNamespace ); + }, + + _destroy: $.noop, + + widget: function() { + return this.element; + }, + + option: function( key, value ) { + var options = key; + var parts; + var curOption; + var i; + + if ( arguments.length === 0 ) { + + // Don't return a reference to the internal hash + return $.widget.extend( {}, this.options ); + } + + if ( typeof key === "string" ) { + + // Handle nested keys, e.g., "foo.bar" => { foo: { bar: ___ } } + options = {}; + parts = key.split( "." ); + key = parts.shift(); + if ( parts.length ) { + curOption = options[ key ] = $.widget.extend( {}, this.options[ key ] ); + for ( i = 0; i < parts.length - 1; i++ ) { + curOption[ parts[ i ] ] = curOption[ parts[ i ] ] || {}; + curOption = curOption[ parts[ i ] ]; + } + key = parts.pop(); + if ( arguments.length === 1 ) { + return curOption[ key ] === undefined ? null : curOption[ key ]; + } + curOption[ key ] = value; + } else { + if ( arguments.length === 1 ) { + return this.options[ key ] === undefined ? null : this.options[ key ]; + } + options[ key ] = value; + } + } + + this._setOptions( options ); + + return this; + }, + + _setOptions: function( options ) { + var key; + + for ( key in options ) { + this._setOption( key, options[ key ] ); + } + + return this; + }, + + _setOption: function( key, value ) { + if ( key === "classes" ) { + this._setOptionClasses( value ); + } + + this.options[ key ] = value; + + if ( key === "disabled" ) { + this._setOptionDisabled( value ); + } + + return this; + }, + + _setOptionClasses: function( value ) { + var classKey, elements, currentElements; + + for ( classKey in value ) { + currentElements = this.classesElementLookup[ classKey ]; + if ( value[ classKey ] === this.options.classes[ classKey ] || + !currentElements || + !currentElements.length ) { + continue; + } + + // We are doing this to create a new jQuery object because the _removeClass() call + // on the next line is going to destroy the reference to the current elements being + // tracked. We need to save a copy of this collection so that we can add the new classes + // below. + elements = $( currentElements.get() ); + this._removeClass( currentElements, classKey ); + + // We don't use _addClass() here, because that uses this.options.classes + // for generating the string of classes. We want to use the value passed in from + // _setOption(), this is the new value of the classes option which was passed to + // _setOption(). We pass this value directly to _classes(). + elements.addClass( this._classes( { + element: elements, + keys: classKey, + classes: value, + add: true + } ) ); + } + }, + + _setOptionDisabled: function( value ) { + this._toggleClass( this.widget(), this.widgetFullName + "-disabled", null, !!value ); + + // If the widget is becoming disabled, then nothing is interactive + if ( value ) { + this._removeClass( this.hoverable, null, "ui-state-hover" ); + this._removeClass( this.focusable, null, "ui-state-focus" ); + } + }, + + enable: function() { + return this._setOptions( { disabled: false } ); + }, + + disable: function() { + return this._setOptions( { disabled: true } ); + }, + + _classes: function( options ) { + var full = []; + var that = this; + + options = $.extend( { + element: this.element, + classes: this.options.classes || {} + }, options ); + + function processClassString( classes, checkOption ) { + var current, i; + for ( i = 0; i < classes.length; i++ ) { + current = that.classesElementLookup[ classes[ i ] ] || $(); + if ( options.add ) { + current = $( $.unique( current.get().concat( options.element.get() ) ) ); + } else { + current = $( current.not( options.element ).get() ); + } + that.classesElementLookup[ classes[ i ] ] = current; + full.push( classes[ i ] ); + if ( checkOption && options.classes[ classes[ i ] ] ) { + full.push( options.classes[ classes[ i ] ] ); + } + } + } + + this._on( options.element, { + "remove": "_untrackClassesElement" + } ); + + if ( options.keys ) { + processClassString( options.keys.match( /\S+/g ) || [], true ); + } + if ( options.extra ) { + processClassString( options.extra.match( /\S+/g ) || [] ); + } + + return full.join( " " ); + }, + + _untrackClassesElement: function( event ) { + var that = this; + $.each( that.classesElementLookup, function( key, value ) { + if ( $.inArray( event.target, value ) !== -1 ) { + that.classesElementLookup[ key ] = $( value.not( event.target ).get() ); + } + } ); + }, + + _removeClass: function( element, keys, extra ) { + return this._toggleClass( element, keys, extra, false ); + }, + + _addClass: function( element, keys, extra ) { + return this._toggleClass( element, keys, extra, true ); + }, + + _toggleClass: function( element, keys, extra, add ) { + add = ( typeof add === "boolean" ) ? add : extra; + var shift = ( typeof element === "string" || element === null ), + options = { + extra: shift ? keys : extra, + keys: shift ? element : keys, + element: shift ? this.element : element, + add: add + }; + options.element.toggleClass( this._classes( options ), add ); + return this; + }, + + _on: function( suppressDisabledCheck, element, handlers ) { + var delegateElement; + var instance = this; + + // No suppressDisabledCheck flag, shuffle arguments + if ( typeof suppressDisabledCheck !== "boolean" ) { + handlers = element; + element = suppressDisabledCheck; + suppressDisabledCheck = false; + } + + // No element argument, shuffle and use this.element + if ( !handlers ) { + handlers = element; + element = this.element; + delegateElement = this.widget(); + } else { + element = delegateElement = $( element ); + this.bindings = this.bindings.add( element ); + } + + $.each( handlers, function( event, handler ) { + function handlerProxy() { + + // Allow widgets to customize the disabled handling + // - disabled as an array instead of boolean + // - disabled class as method for disabling individual parts + if ( !suppressDisabledCheck && + ( instance.options.disabled === true || + $( this ).hasClass( "ui-state-disabled" ) ) ) { + return; + } + return ( typeof handler === "string" ? instance[ handler ] : handler ) + .apply( instance, arguments ); + } + + // Copy the guid so direct unbinding works + if ( typeof handler !== "string" ) { + handlerProxy.guid = handler.guid = + handler.guid || handlerProxy.guid || $.guid++; + } + + var match = event.match( /^([\w:-]*)\s*(.*)$/ ); + var eventName = match[ 1 ] + instance.eventNamespace; + var selector = match[ 2 ]; + + if ( selector ) { + delegateElement.on( eventName, selector, handlerProxy ); + } else { + element.on( eventName, handlerProxy ); + } + } ); + }, + + _off: function( element, eventName ) { + eventName = ( eventName || "" ).split( " " ).join( this.eventNamespace + " " ) + + this.eventNamespace; + element.off( eventName ).off( eventName ); + + // Clear the stack to avoid memory leaks (#10056) + this.bindings = $( this.bindings.not( element ).get() ); + this.focusable = $( this.focusable.not( element ).get() ); + this.hoverable = $( this.hoverable.not( element ).get() ); + }, + + _delay: function( handler, delay ) { + function handlerProxy() { + return ( typeof handler === "string" ? instance[ handler ] : handler ) + .apply( instance, arguments ); + } + var instance = this; + return setTimeout( handlerProxy, delay || 0 ); + }, + + _hoverable: function( element ) { + this.hoverable = this.hoverable.add( element ); + this._on( element, { + mouseenter: function( event ) { + this._addClass( $( event.currentTarget ), null, "ui-state-hover" ); + }, + mouseleave: function( event ) { + this._removeClass( $( event.currentTarget ), null, "ui-state-hover" ); + } + } ); + }, + + _focusable: function( element ) { + this.focusable = this.focusable.add( element ); + this._on( element, { + focusin: function( event ) { + this._addClass( $( event.currentTarget ), null, "ui-state-focus" ); + }, + focusout: function( event ) { + this._removeClass( $( event.currentTarget ), null, "ui-state-focus" ); + } + } ); + }, + + _trigger: function( type, event, data ) { + var prop, orig; + var callback = this.options[ type ]; + + data = data || {}; + event = $.Event( event ); + event.type = ( type === this.widgetEventPrefix ? + type : + this.widgetEventPrefix + type ).toLowerCase(); + + // The original event may come from any element + // so we need to reset the target on the new event + event.target = this.element[ 0 ]; + + // Copy original event properties over to the new event + orig = event.originalEvent; + if ( orig ) { + for ( prop in orig ) { + if ( !( prop in event ) ) { + event[ prop ] = orig[ prop ]; + } + } + } + + this.element.trigger( event, data ); + return !( $.isFunction( callback ) && + callback.apply( this.element[ 0 ], [ event ].concat( data ) ) === false || + event.isDefaultPrevented() ); + } +}; + +$.each( { show: "fadeIn", hide: "fadeOut" }, function( method, defaultEffect ) { + $.Widget.prototype[ "_" + method ] = function( element, options, callback ) { + if ( typeof options === "string" ) { + options = { effect: options }; + } + + var hasOptions; + var effectName = !options ? + method : + options === true || typeof options === "number" ? + defaultEffect : + options.effect || defaultEffect; + + options = options || {}; + if ( typeof options === "number" ) { + options = { duration: options }; + } + + hasOptions = !$.isEmptyObject( options ); + options.complete = callback; + + if ( options.delay ) { + element.delay( options.delay ); + } + + if ( hasOptions && $.effects && $.effects.effect[ effectName ] ) { + element[ method ]( options ); + } else if ( effectName !== method && element[ effectName ] ) { + element[ effectName ]( options.duration, options.easing, callback ); + } else { + element.queue( function( next ) { + $( this )[ method ](); + if ( callback ) { + callback.call( element[ 0 ] ); + } + next(); + } ); + } + }; +} ); + +var widget = $.widget; + + +/*! + * jQuery UI Position 1.12.1 + * http://jqueryui.com + * + * Copyright jQuery Foundation and other contributors + * Released under the MIT license. + * http://jquery.org/license + * + * http://api.jqueryui.com/position/ + */ + +//>>label: Position +//>>group: Core +//>>description: Positions elements relative to other elements. +//>>docs: http://api.jqueryui.com/position/ +//>>demos: http://jqueryui.com/position/ + + +( function() { +var cachedScrollbarWidth, + max = Math.max, + abs = Math.abs, + rhorizontal = /left|center|right/, + rvertical = /top|center|bottom/, + roffset = /[\+\-]\d+(\.[\d]+)?%?/, + rposition = /^\w+/, + rpercent = /%$/, + _position = $.fn.position; + +function getOffsets( offsets, width, height ) { + return [ + parseFloat( offsets[ 0 ] ) * ( rpercent.test( offsets[ 0 ] ) ? width / 100 : 1 ), + parseFloat( offsets[ 1 ] ) * ( rpercent.test( offsets[ 1 ] ) ? height / 100 : 1 ) + ]; +} + +function parseCss( element, property ) { + return parseInt( $.css( element, property ), 10 ) || 0; +} + +function getDimensions( elem ) { + var raw = elem[ 0 ]; + if ( raw.nodeType === 9 ) { + return { + width: elem.width(), + height: elem.height(), + offset: { top: 0, left: 0 } + }; + } + if ( $.isWindow( raw ) ) { + return { + width: elem.width(), + height: elem.height(), + offset: { top: elem.scrollTop(), left: elem.scrollLeft() } + }; + } + if ( raw.preventDefault ) { + return { + width: 0, + height: 0, + offset: { top: raw.pageY, left: raw.pageX } + }; + } + return { + width: elem.outerWidth(), + height: elem.outerHeight(), + offset: elem.offset() + }; +} + +$.position = { + scrollbarWidth: function() { + if ( cachedScrollbarWidth !== undefined ) { + return cachedScrollbarWidth; + } + var w1, w2, + div = $( "
" + + "
" ), + innerDiv = div.children()[ 0 ]; + + $( "body" ).append( div ); + w1 = innerDiv.offsetWidth; + div.css( "overflow", "scroll" ); + + w2 = innerDiv.offsetWidth; + + if ( w1 === w2 ) { + w2 = div[ 0 ].clientWidth; + } + + div.remove(); + + return ( cachedScrollbarWidth = w1 - w2 ); + }, + getScrollInfo: function( within ) { + var overflowX = within.isWindow || within.isDocument ? "" : + within.element.css( "overflow-x" ), + overflowY = within.isWindow || within.isDocument ? "" : + within.element.css( "overflow-y" ), + hasOverflowX = overflowX === "scroll" || + ( overflowX === "auto" && within.width < within.element[ 0 ].scrollWidth ), + hasOverflowY = overflowY === "scroll" || + ( overflowY === "auto" && within.height < within.element[ 0 ].scrollHeight ); + return { + width: hasOverflowY ? $.position.scrollbarWidth() : 0, + height: hasOverflowX ? $.position.scrollbarWidth() : 0 + }; + }, + getWithinInfo: function( element ) { + var withinElement = $( element || window ), + isWindow = $.isWindow( withinElement[ 0 ] ), + isDocument = !!withinElement[ 0 ] && withinElement[ 0 ].nodeType === 9, + hasOffset = !isWindow && !isDocument; + return { + element: withinElement, + isWindow: isWindow, + isDocument: isDocument, + offset: hasOffset ? $( element ).offset() : { left: 0, top: 0 }, + scrollLeft: withinElement.scrollLeft(), + scrollTop: withinElement.scrollTop(), + width: withinElement.outerWidth(), + height: withinElement.outerHeight() + }; + } +}; + +$.fn.position = function( options ) { + if ( !options || !options.of ) { + return _position.apply( this, arguments ); + } + + // Make a copy, we don't want to modify arguments + options = $.extend( {}, options ); + + var atOffset, targetWidth, targetHeight, targetOffset, basePosition, dimensions, + target = $( options.of ), + within = $.position.getWithinInfo( options.within ), + scrollInfo = $.position.getScrollInfo( within ), + collision = ( options.collision || "flip" ).split( " " ), + offsets = {}; + + dimensions = getDimensions( target ); + if ( target[ 0 ].preventDefault ) { + + // Force left top to allow flipping + options.at = "left top"; + } + targetWidth = dimensions.width; + targetHeight = dimensions.height; + targetOffset = dimensions.offset; + + // Clone to reuse original targetOffset later + basePosition = $.extend( {}, targetOffset ); + + // Force my and at to have valid horizontal and vertical positions + // if a value is missing or invalid, it will be converted to center + $.each( [ "my", "at" ], function() { + var pos = ( options[ this ] || "" ).split( " " ), + horizontalOffset, + verticalOffset; + + if ( pos.length === 1 ) { + pos = rhorizontal.test( pos[ 0 ] ) ? + pos.concat( [ "center" ] ) : + rvertical.test( pos[ 0 ] ) ? + [ "center" ].concat( pos ) : + [ "center", "center" ]; + } + pos[ 0 ] = rhorizontal.test( pos[ 0 ] ) ? pos[ 0 ] : "center"; + pos[ 1 ] = rvertical.test( pos[ 1 ] ) ? pos[ 1 ] : "center"; + + // Calculate offsets + horizontalOffset = roffset.exec( pos[ 0 ] ); + verticalOffset = roffset.exec( pos[ 1 ] ); + offsets[ this ] = [ + horizontalOffset ? horizontalOffset[ 0 ] : 0, + verticalOffset ? verticalOffset[ 0 ] : 0 + ]; + + // Reduce to just the positions without the offsets + options[ this ] = [ + rposition.exec( pos[ 0 ] )[ 0 ], + rposition.exec( pos[ 1 ] )[ 0 ] + ]; + } ); + + // Normalize collision option + if ( collision.length === 1 ) { + collision[ 1 ] = collision[ 0 ]; + } + + if ( options.at[ 0 ] === "right" ) { + basePosition.left += targetWidth; + } else if ( options.at[ 0 ] === "center" ) { + basePosition.left += targetWidth / 2; + } + + if ( options.at[ 1 ] === "bottom" ) { + basePosition.top += targetHeight; + } else if ( options.at[ 1 ] === "center" ) { + basePosition.top += targetHeight / 2; + } + + atOffset = getOffsets( offsets.at, targetWidth, targetHeight ); + basePosition.left += atOffset[ 0 ]; + basePosition.top += atOffset[ 1 ]; + + return this.each( function() { + var collisionPosition, using, + elem = $( this ), + elemWidth = elem.outerWidth(), + elemHeight = elem.outerHeight(), + marginLeft = parseCss( this, "marginLeft" ), + marginTop = parseCss( this, "marginTop" ), + collisionWidth = elemWidth + marginLeft + parseCss( this, "marginRight" ) + + scrollInfo.width, + collisionHeight = elemHeight + marginTop + parseCss( this, "marginBottom" ) + + scrollInfo.height, + position = $.extend( {}, basePosition ), + myOffset = getOffsets( offsets.my, elem.outerWidth(), elem.outerHeight() ); + + if ( options.my[ 0 ] === "right" ) { + position.left -= elemWidth; + } else if ( options.my[ 0 ] === "center" ) { + position.left -= elemWidth / 2; + } + + if ( options.my[ 1 ] === "bottom" ) { + position.top -= elemHeight; + } else if ( options.my[ 1 ] === "center" ) { + position.top -= elemHeight / 2; + } + + position.left += myOffset[ 0 ]; + position.top += myOffset[ 1 ]; + + collisionPosition = { + marginLeft: marginLeft, + marginTop: marginTop + }; + + $.each( [ "left", "top" ], function( i, dir ) { + if ( $.ui.position[ collision[ i ] ] ) { + $.ui.position[ collision[ i ] ][ dir ]( position, { + targetWidth: targetWidth, + targetHeight: targetHeight, + elemWidth: elemWidth, + elemHeight: elemHeight, + collisionPosition: collisionPosition, + collisionWidth: collisionWidth, + collisionHeight: collisionHeight, + offset: [ atOffset[ 0 ] + myOffset[ 0 ], atOffset [ 1 ] + myOffset[ 1 ] ], + my: options.my, + at: options.at, + within: within, + elem: elem + } ); + } + } ); + + if ( options.using ) { + + // Adds feedback as second argument to using callback, if present + using = function( props ) { + var left = targetOffset.left - position.left, + right = left + targetWidth - elemWidth, + top = targetOffset.top - position.top, + bottom = top + targetHeight - elemHeight, + feedback = { + target: { + element: target, + left: targetOffset.left, + top: targetOffset.top, + width: targetWidth, + height: targetHeight + }, + element: { + element: elem, + left: position.left, + top: position.top, + width: elemWidth, + height: elemHeight + }, + horizontal: right < 0 ? "left" : left > 0 ? "right" : "center", + vertical: bottom < 0 ? "top" : top > 0 ? "bottom" : "middle" + }; + if ( targetWidth < elemWidth && abs( left + right ) < targetWidth ) { + feedback.horizontal = "center"; + } + if ( targetHeight < elemHeight && abs( top + bottom ) < targetHeight ) { + feedback.vertical = "middle"; + } + if ( max( abs( left ), abs( right ) ) > max( abs( top ), abs( bottom ) ) ) { + feedback.important = "horizontal"; + } else { + feedback.important = "vertical"; + } + options.using.call( this, props, feedback ); + }; + } + + elem.offset( $.extend( position, { using: using } ) ); + } ); +}; + +$.ui.position = { + fit: { + left: function( position, data ) { + var within = data.within, + withinOffset = within.isWindow ? within.scrollLeft : within.offset.left, + outerWidth = within.width, + collisionPosLeft = position.left - data.collisionPosition.marginLeft, + overLeft = withinOffset - collisionPosLeft, + overRight = collisionPosLeft + data.collisionWidth - outerWidth - withinOffset, + newOverRight; + + // Element is wider than within + if ( data.collisionWidth > outerWidth ) { + + // Element is initially over the left side of within + if ( overLeft > 0 && overRight <= 0 ) { + newOverRight = position.left + overLeft + data.collisionWidth - outerWidth - + withinOffset; + position.left += overLeft - newOverRight; + + // Element is initially over right side of within + } else if ( overRight > 0 && overLeft <= 0 ) { + position.left = withinOffset; + + // Element is initially over both left and right sides of within + } else { + if ( overLeft > overRight ) { + position.left = withinOffset + outerWidth - data.collisionWidth; + } else { + position.left = withinOffset; + } + } + + // Too far left -> align with left edge + } else if ( overLeft > 0 ) { + position.left += overLeft; + + // Too far right -> align with right edge + } else if ( overRight > 0 ) { + position.left -= overRight; + + // Adjust based on position and margin + } else { + position.left = max( position.left - collisionPosLeft, position.left ); + } + }, + top: function( position, data ) { + var within = data.within, + withinOffset = within.isWindow ? within.scrollTop : within.offset.top, + outerHeight = data.within.height, + collisionPosTop = position.top - data.collisionPosition.marginTop, + overTop = withinOffset - collisionPosTop, + overBottom = collisionPosTop + data.collisionHeight - outerHeight - withinOffset, + newOverBottom; + + // Element is taller than within + if ( data.collisionHeight > outerHeight ) { + + // Element is initially over the top of within + if ( overTop > 0 && overBottom <= 0 ) { + newOverBottom = position.top + overTop + data.collisionHeight - outerHeight - + withinOffset; + position.top += overTop - newOverBottom; + + // Element is initially over bottom of within + } else if ( overBottom > 0 && overTop <= 0 ) { + position.top = withinOffset; + + // Element is initially over both top and bottom of within + } else { + if ( overTop > overBottom ) { + position.top = withinOffset + outerHeight - data.collisionHeight; + } else { + position.top = withinOffset; + } + } + + // Too far up -> align with top + } else if ( overTop > 0 ) { + position.top += overTop; + + // Too far down -> align with bottom edge + } else if ( overBottom > 0 ) { + position.top -= overBottom; + + // Adjust based on position and margin + } else { + position.top = max( position.top - collisionPosTop, position.top ); + } + } + }, + flip: { + left: function( position, data ) { + var within = data.within, + withinOffset = within.offset.left + within.scrollLeft, + outerWidth = within.width, + offsetLeft = within.isWindow ? within.scrollLeft : within.offset.left, + collisionPosLeft = position.left - data.collisionPosition.marginLeft, + overLeft = collisionPosLeft - offsetLeft, + overRight = collisionPosLeft + data.collisionWidth - outerWidth - offsetLeft, + myOffset = data.my[ 0 ] === "left" ? + -data.elemWidth : + data.my[ 0 ] === "right" ? + data.elemWidth : + 0, + atOffset = data.at[ 0 ] === "left" ? + data.targetWidth : + data.at[ 0 ] === "right" ? + -data.targetWidth : + 0, + offset = -2 * data.offset[ 0 ], + newOverRight, + newOverLeft; + + if ( overLeft < 0 ) { + newOverRight = position.left + myOffset + atOffset + offset + data.collisionWidth - + outerWidth - withinOffset; + if ( newOverRight < 0 || newOverRight < abs( overLeft ) ) { + position.left += myOffset + atOffset + offset; + } + } else if ( overRight > 0 ) { + newOverLeft = position.left - data.collisionPosition.marginLeft + myOffset + + atOffset + offset - offsetLeft; + if ( newOverLeft > 0 || abs( newOverLeft ) < overRight ) { + position.left += myOffset + atOffset + offset; + } + } + }, + top: function( position, data ) { + var within = data.within, + withinOffset = within.offset.top + within.scrollTop, + outerHeight = within.height, + offsetTop = within.isWindow ? within.scrollTop : within.offset.top, + collisionPosTop = position.top - data.collisionPosition.marginTop, + overTop = collisionPosTop - offsetTop, + overBottom = collisionPosTop + data.collisionHeight - outerHeight - offsetTop, + top = data.my[ 1 ] === "top", + myOffset = top ? + -data.elemHeight : + data.my[ 1 ] === "bottom" ? + data.elemHeight : + 0, + atOffset = data.at[ 1 ] === "top" ? + data.targetHeight : + data.at[ 1 ] === "bottom" ? + -data.targetHeight : + 0, + offset = -2 * data.offset[ 1 ], + newOverTop, + newOverBottom; + if ( overTop < 0 ) { + newOverBottom = position.top + myOffset + atOffset + offset + data.collisionHeight - + outerHeight - withinOffset; + if ( newOverBottom < 0 || newOverBottom < abs( overTop ) ) { + position.top += myOffset + atOffset + offset; + } + } else if ( overBottom > 0 ) { + newOverTop = position.top - data.collisionPosition.marginTop + myOffset + atOffset + + offset - offsetTop; + if ( newOverTop > 0 || abs( newOverTop ) < overBottom ) { + position.top += myOffset + atOffset + offset; + } + } + } + }, + flipfit: { + left: function() { + $.ui.position.flip.left.apply( this, arguments ); + $.ui.position.fit.left.apply( this, arguments ); + }, + top: function() { + $.ui.position.flip.top.apply( this, arguments ); + $.ui.position.fit.top.apply( this, arguments ); + } + } +}; + +} )(); + +var position = $.ui.position; + + +/*! + * jQuery UI :data 1.12.1 + * http://jqueryui.com + * + * Copyright jQuery Foundation and other contributors + * Released under the MIT license. + * http://jquery.org/license + */ + +//>>label: :data Selector +//>>group: Core +//>>description: Selects elements which have data stored under the specified key. +//>>docs: http://api.jqueryui.com/data-selector/ + + +var data = $.extend( $.expr[ ":" ], { + data: $.expr.createPseudo ? + $.expr.createPseudo( function( dataName ) { + return function( elem ) { + return !!$.data( elem, dataName ); + }; + } ) : + + // Support: jQuery <1.8 + function( elem, i, match ) { + return !!$.data( elem, match[ 3 ] ); + } +} ); + +/*! + * jQuery UI Disable Selection 1.12.1 + * http://jqueryui.com + * + * Copyright jQuery Foundation and other contributors + * Released under the MIT license. + * http://jquery.org/license + */ + +//>>label: disableSelection +//>>group: Core +//>>description: Disable selection of text content within the set of matched elements. +//>>docs: http://api.jqueryui.com/disableSelection/ + +// This file is deprecated + + +var disableSelection = $.fn.extend( { + disableSelection: ( function() { + var eventType = "onselectstart" in document.createElement( "div" ) ? + "selectstart" : + "mousedown"; + + return function() { + return this.on( eventType + ".ui-disableSelection", function( event ) { + event.preventDefault(); + } ); + }; + } )(), + + enableSelection: function() { + return this.off( ".ui-disableSelection" ); + } +} ); + + +/*! + * jQuery UI Focusable 1.12.1 + * http://jqueryui.com + * + * Copyright jQuery Foundation and other contributors + * Released under the MIT license. + * http://jquery.org/license + */ + +//>>label: :focusable Selector +//>>group: Core +//>>description: Selects elements which can be focused. +//>>docs: http://api.jqueryui.com/focusable-selector/ + + + +// Selectors +$.ui.focusable = function( element, hasTabindex ) { + var map, mapName, img, focusableIfVisible, fieldset, + nodeName = element.nodeName.toLowerCase(); + + if ( "area" === nodeName ) { + map = element.parentNode; + mapName = map.name; + if ( !element.href || !mapName || map.nodeName.toLowerCase() !== "map" ) { + return false; + } + img = $( "img[usemap='#" + mapName + "']" ); + return img.length > 0 && img.is( ":visible" ); + } + + if ( /^(input|select|textarea|button|object)$/.test( nodeName ) ) { + focusableIfVisible = !element.disabled; + + if ( focusableIfVisible ) { + + // Form controls within a disabled fieldset are disabled. + // However, controls within the fieldset's legend do not get disabled. + // Since controls generally aren't placed inside legends, we skip + // this portion of the check. + fieldset = $( element ).closest( "fieldset" )[ 0 ]; + if ( fieldset ) { + focusableIfVisible = !fieldset.disabled; + } + } + } else if ( "a" === nodeName ) { + focusableIfVisible = element.href || hasTabindex; + } else { + focusableIfVisible = hasTabindex; + } + + return focusableIfVisible && $( element ).is( ":visible" ) && visible( $( element ) ); +}; + +// Support: IE 8 only +// IE 8 doesn't resolve inherit to visible/hidden for computed values +function visible( element ) { + var visibility = element.css( "visibility" ); + while ( visibility === "inherit" ) { + element = element.parent(); + visibility = element.css( "visibility" ); + } + return visibility !== "hidden"; +} + +$.extend( $.expr[ ":" ], { + focusable: function( element ) { + return $.ui.focusable( element, $.attr( element, "tabindex" ) != null ); + } +} ); + +var focusable = $.ui.focusable; + + + + +// Support: IE8 Only +// IE8 does not support the form attribute and when it is supplied. It overwrites the form prop +// with a string, so we need to find the proper form. +var form = $.fn.form = function() { + return typeof this[ 0 ].form === "string" ? this.closest( "form" ) : $( this[ 0 ].form ); +}; + + +/*! + * jQuery UI Form Reset Mixin 1.12.1 + * http://jqueryui.com + * + * Copyright jQuery Foundation and other contributors + * Released under the MIT license. + * http://jquery.org/license + */ + +//>>label: Form Reset Mixin +//>>group: Core +//>>description: Refresh input widgets when their form is reset +//>>docs: http://api.jqueryui.com/form-reset-mixin/ + + + +var formResetMixin = $.ui.formResetMixin = { + _formResetHandler: function() { + var form = $( this ); + + // Wait for the form reset to actually happen before refreshing + setTimeout( function() { + var instances = form.data( "ui-form-reset-instances" ); + $.each( instances, function() { + this.refresh(); + } ); + } ); + }, + + _bindFormResetHandler: function() { + this.form = this.element.form(); + if ( !this.form.length ) { + return; + } + + var instances = this.form.data( "ui-form-reset-instances" ) || []; + if ( !instances.length ) { + + // We don't use _on() here because we use a single event handler per form + this.form.on( "reset.ui-form-reset", this._formResetHandler ); + } + instances.push( this ); + this.form.data( "ui-form-reset-instances", instances ); + }, + + _unbindFormResetHandler: function() { + if ( !this.form.length ) { + return; + } + + var instances = this.form.data( "ui-form-reset-instances" ); + instances.splice( $.inArray( this, instances ), 1 ); + if ( instances.length ) { + this.form.data( "ui-form-reset-instances", instances ); + } else { + this.form + .removeData( "ui-form-reset-instances" ) + .off( "reset.ui-form-reset" ); + } + } +}; + + +/*! + * jQuery UI Support for jQuery core 1.7.x 1.12.1 + * http://jqueryui.com + * + * Copyright jQuery Foundation and other contributors + * Released under the MIT license. + * http://jquery.org/license + * + */ + +//>>label: jQuery 1.7 Support +//>>group: Core +//>>description: Support version 1.7.x of jQuery core + + + +// Support: jQuery 1.7 only +// Not a great way to check versions, but since we only support 1.7+ and only +// need to detect <1.8, this is a simple check that should suffice. Checking +// for "1.7." would be a bit safer, but the version string is 1.7, not 1.7.0 +// and we'll never reach 1.70.0 (if we do, we certainly won't be supporting +// 1.7 anymore). See #11197 for why we're not using feature detection. +if ( $.fn.jquery.substring( 0, 3 ) === "1.7" ) { + + // Setters for .innerWidth(), .innerHeight(), .outerWidth(), .outerHeight() + // Unlike jQuery Core 1.8+, these only support numeric values to set the + // dimensions in pixels + $.each( [ "Width", "Height" ], function( i, name ) { + var side = name === "Width" ? [ "Left", "Right" ] : [ "Top", "Bottom" ], + type = name.toLowerCase(), + orig = { + innerWidth: $.fn.innerWidth, + innerHeight: $.fn.innerHeight, + outerWidth: $.fn.outerWidth, + outerHeight: $.fn.outerHeight + }; + + function reduce( elem, size, border, margin ) { + $.each( side, function() { + size -= parseFloat( $.css( elem, "padding" + this ) ) || 0; + if ( border ) { + size -= parseFloat( $.css( elem, "border" + this + "Width" ) ) || 0; + } + if ( margin ) { + size -= parseFloat( $.css( elem, "margin" + this ) ) || 0; + } + } ); + return size; + } + + $.fn[ "inner" + name ] = function( size ) { + if ( size === undefined ) { + return orig[ "inner" + name ].call( this ); + } + + return this.each( function() { + $( this ).css( type, reduce( this, size ) + "px" ); + } ); + }; + + $.fn[ "outer" + name ] = function( size, margin ) { + if ( typeof size !== "number" ) { + return orig[ "outer" + name ].call( this, size ); + } + + return this.each( function() { + $( this ).css( type, reduce( this, size, true, margin ) + "px" ); + } ); + }; + } ); + + $.fn.addBack = function( selector ) { + return this.add( selector == null ? + this.prevObject : this.prevObject.filter( selector ) + ); + }; +} + +; +/*! + * jQuery UI Keycode 1.12.1 + * http://jqueryui.com + * + * Copyright jQuery Foundation and other contributors + * Released under the MIT license. + * http://jquery.org/license + */ + +//>>label: Keycode +//>>group: Core +//>>description: Provide keycodes as keynames +//>>docs: http://api.jqueryui.com/jQuery.ui.keyCode/ + + +var keycode = $.ui.keyCode = { + BACKSPACE: 8, + COMMA: 188, + DELETE: 46, + DOWN: 40, + END: 35, + ENTER: 13, + ESCAPE: 27, + HOME: 36, + LEFT: 37, + PAGE_DOWN: 34, + PAGE_UP: 33, + PERIOD: 190, + RIGHT: 39, + SPACE: 32, + TAB: 9, + UP: 38 +}; + + + + +// Internal use only +var escapeSelector = $.ui.escapeSelector = ( function() { + var selectorEscape = /([!"#$%&'()*+,./:;<=>?@[\]^`{|}~])/g; + return function( selector ) { + return selector.replace( selectorEscape, "\\$1" ); + }; +} )(); + + +/*! + * jQuery UI Labels 1.12.1 + * http://jqueryui.com + * + * Copyright jQuery Foundation and other contributors + * Released under the MIT license. + * http://jquery.org/license + */ + +//>>label: labels +//>>group: Core +//>>description: Find all the labels associated with a given input +//>>docs: http://api.jqueryui.com/labels/ + + + +var labels = $.fn.labels = function() { + var ancestor, selector, id, labels, ancestors; + + // Check control.labels first + if ( this[ 0 ].labels && this[ 0 ].labels.length ) { + return this.pushStack( this[ 0 ].labels ); + } + + // Support: IE <= 11, FF <= 37, Android <= 2.3 only + // Above browsers do not support control.labels. Everything below is to support them + // as well as document fragments. control.labels does not work on document fragments + labels = this.eq( 0 ).parents( "label" ); + + // Look for the label based on the id + id = this.attr( "id" ); + if ( id ) { + + // We don't search against the document in case the element + // is disconnected from the DOM + ancestor = this.eq( 0 ).parents().last(); + + // Get a full set of top level ancestors + ancestors = ancestor.add( ancestor.length ? ancestor.siblings() : this.siblings() ); + + // Create a selector for the label based on the id + selector = "label[for='" + $.ui.escapeSelector( id ) + "']"; + + labels = labels.add( ancestors.find( selector ).addBack( selector ) ); + + } + + // Return whatever we have found for labels + return this.pushStack( labels ); +}; + + +/*! + * jQuery UI Scroll Parent 1.12.1 + * http://jqueryui.com + * + * Copyright jQuery Foundation and other contributors + * Released under the MIT license. + * http://jquery.org/license + */ + +//>>label: scrollParent +//>>group: Core +//>>description: Get the closest ancestor element that is scrollable. +//>>docs: http://api.jqueryui.com/scrollParent/ + + + +var scrollParent = $.fn.scrollParent = function( includeHidden ) { + var position = this.css( "position" ), + excludeStaticParent = position === "absolute", + overflowRegex = includeHidden ? /(auto|scroll|hidden)/ : /(auto|scroll)/, + scrollParent = this.parents().filter( function() { + var parent = $( this ); + if ( excludeStaticParent && parent.css( "position" ) === "static" ) { + return false; + } + return overflowRegex.test( parent.css( "overflow" ) + parent.css( "overflow-y" ) + + parent.css( "overflow-x" ) ); + } ).eq( 0 ); + + return position === "fixed" || !scrollParent.length ? + $( this[ 0 ].ownerDocument || document ) : + scrollParent; +}; + + +/*! + * jQuery UI Tabbable 1.12.1 + * http://jqueryui.com + * + * Copyright jQuery Foundation and other contributors + * Released under the MIT license. + * http://jquery.org/license + */ + +//>>label: :tabbable Selector +//>>group: Core +//>>description: Selects elements which can be tabbed to. +//>>docs: http://api.jqueryui.com/tabbable-selector/ + + + +var tabbable = $.extend( $.expr[ ":" ], { + tabbable: function( element ) { + var tabIndex = $.attr( element, "tabindex" ), + hasTabindex = tabIndex != null; + return ( !hasTabindex || tabIndex >= 0 ) && $.ui.focusable( element, hasTabindex ); + } +} ); + + +/*! + * jQuery UI Unique ID 1.12.1 + * http://jqueryui.com + * + * Copyright jQuery Foundation and other contributors + * Released under the MIT license. + * http://jquery.org/license + */ + +//>>label: uniqueId +//>>group: Core +//>>description: Functions to generate and remove uniqueId's +//>>docs: http://api.jqueryui.com/uniqueId/ + + + +var uniqueId = $.fn.extend( { + uniqueId: ( function() { + var uuid = 0; + + return function() { + return this.each( function() { + if ( !this.id ) { + this.id = "ui-id-" + ( ++uuid ); + } + } ); + }; + } )(), + + removeUniqueId: function() { + return this.each( function() { + if ( /^ui-id-\d+$/.test( this.id ) ) { + $( this ).removeAttr( "id" ); + } + } ); + } +} ); + + + + +// This file is deprecated +var ie = $.ui.ie = !!/msie [\w.]+/.exec( navigator.userAgent.toLowerCase() ); + +/*! + * jQuery UI Mouse 1.12.1 + * http://jqueryui.com + * + * Copyright jQuery Foundation and other contributors + * Released under the MIT license. + * http://jquery.org/license + */ + +//>>label: Mouse +//>>group: Widgets +//>>description: Abstracts mouse-based interactions to assist in creating certain widgets. +//>>docs: http://api.jqueryui.com/mouse/ + + + +var mouseHandled = false; +$( document ).on( "mouseup", function() { + mouseHandled = false; +} ); + +var widgetsMouse = $.widget( "ui.mouse", { + version: "1.12.1", + options: { + cancel: "input, textarea, button, select, option", + distance: 1, + delay: 0 + }, + _mouseInit: function() { + var that = this; + + this.element + .on( "mousedown." + this.widgetName, function( event ) { + return that._mouseDown( event ); + } ) + .on( "click." + this.widgetName, function( event ) { + if ( true === $.data( event.target, that.widgetName + ".preventClickEvent" ) ) { + $.removeData( event.target, that.widgetName + ".preventClickEvent" ); + event.stopImmediatePropagation(); + return false; + } + } ); + + this.started = false; + }, + + // TODO: make sure destroying one instance of mouse doesn't mess with + // other instances of mouse + _mouseDestroy: function() { + this.element.off( "." + this.widgetName ); + if ( this._mouseMoveDelegate ) { + this.document + .off( "mousemove." + this.widgetName, this._mouseMoveDelegate ) + .off( "mouseup." + this.widgetName, this._mouseUpDelegate ); + } + }, + + _mouseDown: function( event ) { + + // don't let more than one widget handle mouseStart + if ( mouseHandled ) { + return; + } + + this._mouseMoved = false; + + // We may have missed mouseup (out of window) + ( this._mouseStarted && this._mouseUp( event ) ); + + this._mouseDownEvent = event; + + var that = this, + btnIsLeft = ( event.which === 1 ), + + // event.target.nodeName works around a bug in IE 8 with + // disabled inputs (#7620) + elIsCancel = ( typeof this.options.cancel === "string" && event.target.nodeName ? + $( event.target ).closest( this.options.cancel ).length : false ); + if ( !btnIsLeft || elIsCancel || !this._mouseCapture( event ) ) { + return true; + } + + this.mouseDelayMet = !this.options.delay; + if ( !this.mouseDelayMet ) { + this._mouseDelayTimer = setTimeout( function() { + that.mouseDelayMet = true; + }, this.options.delay ); + } + + if ( this._mouseDistanceMet( event ) && this._mouseDelayMet( event ) ) { + this._mouseStarted = ( this._mouseStart( event ) !== false ); + if ( !this._mouseStarted ) { + event.preventDefault(); + return true; + } + } + + // Click event may never have fired (Gecko & Opera) + if ( true === $.data( event.target, this.widgetName + ".preventClickEvent" ) ) { + $.removeData( event.target, this.widgetName + ".preventClickEvent" ); + } + + // These delegates are required to keep context + this._mouseMoveDelegate = function( event ) { + return that._mouseMove( event ); + }; + this._mouseUpDelegate = function( event ) { + return that._mouseUp( event ); + }; + + this.document + .on( "mousemove." + this.widgetName, this._mouseMoveDelegate ) + .on( "mouseup." + this.widgetName, this._mouseUpDelegate ); + + event.preventDefault(); + + mouseHandled = true; + return true; + }, + + _mouseMove: function( event ) { + + // Only check for mouseups outside the document if you've moved inside the document + // at least once. This prevents the firing of mouseup in the case of IE<9, which will + // fire a mousemove event if content is placed under the cursor. See #7778 + // Support: IE <9 + if ( this._mouseMoved ) { + + // IE mouseup check - mouseup happened when mouse was out of window + if ( $.ui.ie && ( !document.documentMode || document.documentMode < 9 ) && + !event.button ) { + return this._mouseUp( event ); + + // Iframe mouseup check - mouseup occurred in another document + } else if ( !event.which ) { + + // Support: Safari <=8 - 9 + // Safari sets which to 0 if you press any of the following keys + // during a drag (#14461) + if ( event.originalEvent.altKey || event.originalEvent.ctrlKey || + event.originalEvent.metaKey || event.originalEvent.shiftKey ) { + this.ignoreMissingWhich = true; + } else if ( !this.ignoreMissingWhich ) { + return this._mouseUp( event ); + } + } + } + + if ( event.which || event.button ) { + this._mouseMoved = true; + } + + if ( this._mouseStarted ) { + this._mouseDrag( event ); + return event.preventDefault(); + } + + if ( this._mouseDistanceMet( event ) && this._mouseDelayMet( event ) ) { + this._mouseStarted = + ( this._mouseStart( this._mouseDownEvent, event ) !== false ); + ( this._mouseStarted ? this._mouseDrag( event ) : this._mouseUp( event ) ); + } + + return !this._mouseStarted; + }, + + _mouseUp: function( event ) { + this.document + .off( "mousemove." + this.widgetName, this._mouseMoveDelegate ) + .off( "mouseup." + this.widgetName, this._mouseUpDelegate ); + + if ( this._mouseStarted ) { + this._mouseStarted = false; + + if ( event.target === this._mouseDownEvent.target ) { + $.data( event.target, this.widgetName + ".preventClickEvent", true ); + } + + this._mouseStop( event ); + } + + if ( this._mouseDelayTimer ) { + clearTimeout( this._mouseDelayTimer ); + delete this._mouseDelayTimer; + } + + this.ignoreMissingWhich = false; + mouseHandled = false; + event.preventDefault(); + }, + + _mouseDistanceMet: function( event ) { + return ( Math.max( + Math.abs( this._mouseDownEvent.pageX - event.pageX ), + Math.abs( this._mouseDownEvent.pageY - event.pageY ) + ) >= this.options.distance + ); + }, + + _mouseDelayMet: function( /* event */ ) { + return this.mouseDelayMet; + }, + + // These are placeholder methods, to be overriden by extending plugin + _mouseStart: function( /* event */ ) {}, + _mouseDrag: function( /* event */ ) {}, + _mouseStop: function( /* event */ ) {}, + _mouseCapture: function( /* event */ ) { return true; } +} ); + + + + +// $.ui.plugin is deprecated. Use $.widget() extensions instead. +var plugin = $.ui.plugin = { + add: function( module, option, set ) { + var i, + proto = $.ui[ module ].prototype; + for ( i in set ) { + proto.plugins[ i ] = proto.plugins[ i ] || []; + proto.plugins[ i ].push( [ option, set[ i ] ] ); + } + }, + call: function( instance, name, args, allowDisconnected ) { + var i, + set = instance.plugins[ name ]; + + if ( !set ) { + return; + } + + if ( !allowDisconnected && ( !instance.element[ 0 ].parentNode || + instance.element[ 0 ].parentNode.nodeType === 11 ) ) { + return; + } + + for ( i = 0; i < set.length; i++ ) { + if ( instance.options[ set[ i ][ 0 ] ] ) { + set[ i ][ 1 ].apply( instance.element, args ); + } + } + } +}; + + + +var safeActiveElement = $.ui.safeActiveElement = function( document ) { + var activeElement; + + // Support: IE 9 only + // IE9 throws an "Unspecified error" accessing document.activeElement from an